https://community.splunk.com/t5/Splunk-Search/indexer-search-limits-reached/m-p/288471#M87357 <P>It is saying that your events have <CODE>subseconds</CODE> (usually milliseconds) so instead of a time like <CODE>Dec 25 2017 23:30:12</CODE>, they are like <CODE>Dec 25 2017 23:30:12.345</CODE>. And on top of that, the events as returned to you (which are normally sorted in newest-to-oldest order, WILL be that way up until the <CODE>subseconds</CODE> part (in my example, the <CODE>Dec 25 2017 23:30:12</CODE> part) but may NOT be properly sorted for each second within the <CODE>subseconds</CODE> part (in my example, the <CODE>.345</CODE> part. If this is important to you, be sure to add <CODE>| sort 0 - _time</CODE> as the first command after your base search to resort the events before further processing them.</P> Sun, 26 Mar 2017 22:06:49 GMT woodcock 2017-03-26T22:06:49Z https://community.splunk.com/t5/Splunk-Search/indexer-search-limits-reached/m-p/288470#M87356 <P>Hi,</P> <P>When i ran a command which will fetch the events from last 7 days from a host , splunk is throwing below message. Can anyone please explain in detail about this message.</P> <P>[abcidx01] Events may not be returned in sub-second order due to search memory limits configured in limits.conf [search]:max_rawsize_perchunk. See search.log for more information.</P> Tue, 29 Sep 2020 13:21:17 GMT https://community.splunk.com/t5/Splunk-Search/indexer-search-limits-reached/m-p/288470#M87356 kteng2024 2020-09-29T13:21:17Z https://community.splunk.com/t5/Splunk-Search/indexer-search-limits-reached/m-p/288471#M87357 <P>It is saying that your events have <CODE>subseconds</CODE> (usually milliseconds) so instead of a time like <CODE>Dec 25 2017 23:30:12</CODE>, they are like <CODE>Dec 25 2017 23:30:12.345</CODE>. And on top of that, the events as returned to you (which are normally sorted in newest-to-oldest order, WILL be that way up until the <CODE>subseconds</CODE> part (in my example, the <CODE>Dec 25 2017 23:30:12</CODE> part) but may NOT be properly sorted for each second within the <CODE>subseconds</CODE> part (in my example, the <CODE>.345</CODE> part. If this is important to you, be sure to add <CODE>| sort 0 - _time</CODE> as the first command after your base search to resort the events before further processing them.</P> Sun, 26 Mar 2017 22:06:49 GMT https://community.splunk.com/t5/Splunk-Search/indexer-search-limits-reached/m-p/288471#M87357 woodcock 2017-03-26T22:06:49Z