topic Re: mvexpand truncate result because of exceed 500MB memory usage in Splunk Search

mvexpand truncate result because of exceed 500MB memory usage

ahmedhassanean — Tue, 29 Sep 2020 09:01:10 GMT

Dears,

i have splunk 6.3.3 and i am using query that have command mvexpand but mvexpand truncate result because of exceed 500MB memory usage i have found on splunk doc of version 5 that i can edit limits.conf value of max_memory_usage to higher value than 500MB but it's not working in version 6.3 and also this option not exist in default configuration of limits.conf

please advise

Re: mvexpand truncate result because of exceed 500MB memory usage

somesoni2 — Tue, 08 Mar 2016 22:46:59 GMT

In 6.3.3, the attribute that you're interested in is called max_mem_usage_mb.

Re: mvexpand truncate result because of exceed 500MB memory usage

ahmedhassanean — Tue, 08 Mar 2016 23:13:36 GMT

yes it's the same as 5.0.3 but search query still truncate at 500 MB

Re: mvexpand truncate result because of exceed 500MB memory usage

vasanthmss — Wed, 09 Mar 2016 00:03:51 GMT

You need to increase the size in limits.conf or optimize your search like reduce the data size that needs to be processed by search intervals

Re: mvexpand truncate result because of exceed 500MB memory usage

vasanthmss — Wed, 09 Mar 2016 00:04:54 GMT

What is the search interval you are running now? If possible share some sample data along with search