When I go to the dashboard_live I get the following warning:
Metadata results from this peer are incomplete: the peer has over 100000 entries (see parameter maxcount under the [metadata] stanza in limits.conf), and it will only return metadata information for the first 100000 entries that it encountered. (sid=rt_1365991104.36)
What does this mean exactly and how can I fix it? I can see when I do a ps on the server that there are a few processes running for a long time with the sid in the warning. Which default search are they?
Thanks!
http://docs.splunk.com/Documentation/Splunk/5.0.2/ReleaseNotes/KnownIssues
"Metadata results from this peer are incomplete: the peer has over 100000 entries" message in the summary dashboard in large environment (SPL-58112). To work around this issue, increase the value of [metadata] maxcount=500000 in limits.conf."
http://docs.splunk.com/Documentation/Splunk/5.0.2/ReleaseNotes/KnownIssues
"Metadata results from this peer are incomplete: the peer has over 100000 entries" message in the summary dashboard in large environment (SPL-58112). To work around this issue, increase the value of [metadata] maxcount=500000 in limits.conf."
Hi,
I have increased the maxcount value to 5000000 but still I am getting the error
"Metadata results may be incomplete: 5000000 entries have been received from all peers (see parameter maxcount under the [metadata] stanza in limits.conf), and this search will not return metadata information for any more entries. (sid=rt_1427108700.117555)"
Please suggest a permanent fix for this issue.
Thanks
Surekha
One of the metadata figures is events. It is easy to surpass 5M events.
You really have over 5 million hosts or sourcetypes?
How big can this number get?
I set mine to 5000000 (5 million), and I'm still getting the error.
Thanks for the solution! I just created an app on my deployment server with the necessary override:
[metadata]
maxcount=500000
Deployed it to my search heads and the problem was solved immediately.