topic Re: Why am I getting error "Events may not be returned in sub-second order due to search memory limits configured in limits.conf:[search]:max_rawsize_perchunk"? in Splunk Search

Why am I getting error "Events may not be returned in sub-second order due to search memory limits configured in limits.conf:[search]:max_rawsize_perchunk"?

daniel333 — Sun, 07 Feb 2016 04:28:33 GMT

All,

I am reading other posts about this error, but what is not clear to me, is my customer still gets 100% of the requested logs. Just slowly?

[Server] Events may not be returned in sub-second order due to search memory limits configured in limits.conf:[search]:max_rawsize_perchunk. See search.log for more information.

Re: Why am I getting error "Events may not be returned in sub-second order due to search memory limits configured in limits.conf:[search]:max_rawsize_perchunk"?

martin_mueller — Sun, 07 Feb 2016 14:35:10 GMT

I'm guessing they have a large number of matching events with the same timestamp?
If so, Splunk is not guaranteeing perfect ordering as per the message.

Re: Why am I getting error "Events may not be returned in sub-second order due to search memory limits configured in limits.conf:[search]:max_rawsize_perchunk"?

JensT — Fri, 20 May 2016 13:10:01 GMT

I downvoted this post because "guessing" is not really an appropriate type help.

Re: Why am I getting error "Events may not be returned in sub-second order due to search memory limits configured in limits.conf:[search]:max_rawsize_perchunk"?

martin_mueller — Fri, 20 May 2016 13:39:17 GMT

I'll rephrase: I know that's because of a large number of matching events with the same timestamp. Happy?

Re: Why am I getting error "Events may not be returned in sub-second order due to search memory limits configured in limits.conf:[search]:max_rawsize_perchunk"?

DavidHourani — Fri, 10 Jun 2016 14:46:48 GMT

did you find an answer for this question ? if so can you please post it ?
Thank you.

Re: Why am I getting error "Events may not be returned in sub-second order due to search memory limits configured in limits.conf:[search]:max_rawsize_perchunk"?

lguinn2 — Sun, 12 Jun 2016 14:50:04 GMT

@JensT In this forum, downvoting is used for answers that are wrong, and especially for those answers that could cause harm if used. I appreciate that you took the time to give your reason for downvoting.

Martin did not pose an answer, he made a suggestion as a comment. His comment is clearly intended to further the diagnosis of the problem. As the question itself is very short, his comment elicits additional information that is needed.

Re: Why am I getting error "Events may not be returned in sub-second order due to search memory limits configured in limits.conf:[search]:max_rawsize_perchunk"?

DEAD_BEEF — Thu, 22 Mar 2018 16:53:30 GMT

This question has already been asked before and I know it to be accurately answered. A tldr is that there are a large set of events that exceeds memory usage as defined in limits.conf ( max_mem_usage_mb = 200) which all have the same timestamp. Because of the memory limit, Splunk can't guarantee that they are in perfect sub-second correct order.

You can find much more thorough explanations here and here.

Re: Why am I getting error "Events may not be returned in sub-second order due to search memory limits configured in limits.conf:[search]:max_rawsize_perchunk"?

sansay — Thu, 12 Jul 2018 21:13:41 GMT

The answer by DEAD_BEEF is correct. And the first link to a thorough explanation is the best.
One easy and simple way to get around the problem since version 6.4 is to use sampling.
You can do this by clicking on "No Event Sampling" to select a sampling ratio that fits your needs.

This is also another awesome way to save your splunk system resources.