https://community.splunk.com/t5/Splunk-Search/issue-with-transactions/m-p/98946#M25535 <P>It doesn't look like the subsearch is really needed here, since all it appears to be doing is making sure that the messageid field is populated.</P> <P>How about just:</P> <PRE><CODE>index=smtp messageid=* | transaction messageid </CODE></PRE> Sat, 04 Dec 2010 00:38:00 GMT southeringtonp 2010-12-04T00:38:00Z https://community.splunk.com/t5/Splunk-Search/issue-with-transactions/m-p/98945#M25534 <P>I had previously posted this question earlier: <A href="http://answers.splunk.com/questions/9264/am-i-bumping-into-limits-issue-with-subsearch-results" rel="nofollow">http://answers.splunk.com/questions/9264/am-i-bumping-into-limits-issue-with-subsearch-results</A>. I've done some deeper digging and I believe I'm having a general issue with transactions.</P> <P>I've done a simple search over an index for a 15 minute window and come up with 75,000 events returned. When I run a simple search to build the transactions (<CODE>index=smtp [search index=smtp | fields + messageid] | transaction messageid</CODE>) I end up receiving the same error:</P> <P>Error in 'UnifiedSearch': Unable to parse the 'The specified search is too large. Please try to simplify your search.</P> <P>What can be done to help resolve this issue?</P> <P>Thanks!</P> Fri, 03 Dec 2010 22:57:20 GMT https://community.splunk.com/t5/Splunk-Search/issue-with-transactions/m-p/98945#M25534 castle1126 2010-12-03T22:57:20Z https://community.splunk.com/t5/Splunk-Search/issue-with-transactions/m-p/98946#M25535 <P>It doesn't look like the subsearch is really needed here, since all it appears to be doing is making sure that the messageid field is populated.</P> <P>How about just:</P> <PRE><CODE>index=smtp messageid=* | transaction messageid </CODE></PRE> Sat, 04 Dec 2010 00:38:00 GMT https://community.splunk.com/t5/Splunk-Search/issue-with-transactions/m-p/98946#M25535 southeringtonp 2010-12-04T00:38:00Z https://community.splunk.com/t5/Splunk-Search/issue-with-transactions/m-p/98947#M25536 <P>Thanks much! Doing the search that way worked very nicely...</P> Sat, 04 Dec 2010 02:09:59 GMT https://community.splunk.com/t5/Splunk-Search/issue-with-transactions/m-p/98947#M25536 castle1126 2010-12-04T02:09:59Z