"open in search" returns message 400 Bad request

[rrovers]

My large search works fine in a dashboard but when clicking on the magnifying glass, "open in search" I get a message 400 Bad request

When I delete certain rules from the search it works but I can't figure out what the exact problem is.

I can't find any error in the _internal splunk logs 

Does someone know what causes this error?

[richgalloway]

I suspect there are characters in the query which aren't properly URL-encoded when "open in search" is clicked.  Can you share the working and non-working queries?

[rrovers · Accepted solution]

@richgalloway Thanks for your suggestion. Further analysis learned that it is caused by the length of the URI. Probably some proxy setting. The same URI started from another workstations caused the message: "414 Request-URI Too Large"

[creigmalta]

 The same URI started from another workstations caused the message: "414 Request-URI Too Large"

Under Apache, the limit is a configurable value, LimitRequestLine. Change this value to something larger than its default of 8190 if you want to support a longer request URI. Extremely long URLs are usually a mistake. If you keep URLs under 2000 characters , they'll work in virtually any combination of client and server software. URI actually have a character limit depending on several things. Chrome limits url length of 2MB for practical reasons and to avoid causing denial-of-service problems in inter-process communication. On most platforms, Chrome's omnibox limits URL display to 32kB ( kMaxURLDisplayChars ) although a 1kB limit is used on VR platforms. IE - 2083 characters, Firefox - 2047 characters, Safari 80000 characters and Opera 190,000 characters.

To resolve the problem :

By POST request: Convert query string to json object and sent to API request with POST

By GET request: Max length of request is depend on sever side as well as client side. Most webserver have limit 8k which is configurable. On the client side the different browser has different limit. The browser IE and Safari limit to 2k, Opera 4k and Firefox 8k. means the max length for the GET request is 8k and min request length is 2k.

If exceed the request max length then the request truncated outside the limit by web server or browser without any warning. Some server truncated request data but the some server reject it because of data lose and they will return with response code 414.