Metadata results from this peer are incomplete: the peer has over 100000 entries

[paycorp]

When I go to the dashboard_live I get the following warning:

Metadata results from this peer are incomplete: the peer has over 100000 entries (see parameter maxcount under the [metadata] stanza in limits.conf), and it will only return metadata information for the first 100000 entries that it encountered. (sid=rt_1365991104.36)

What does this mean exactly and how can I fix it? I can see when I do a ps on the server that there are a few processes running for a long time with the sid in the warning. Which default search are they?

Thanks!

[Linegod · Accepted solution]

http://docs.splunk.com/Documentation/Splunk/5.0.2/ReleaseNotes/KnownIssues

"Metadata results from this peer are incomplete: the peer has over 100000 entries" message in the summary dashboard in large environment (SPL-58112). To work around this issue, increase the value of [metadata] maxcount=500000 in limits.conf."

[splunksurekha]

Hi,

I have increased the maxcount value to 5000000 but still I am getting the error

"Metadata results may be incomplete: 5000000 entries have been received from all peers (see parameter maxcount under the [metadata] stanza in limits.conf), and this search will not return metadata information for any more entries. (sid=rt_1427108700.117555)"

Please suggest a permanent fix for this issue.

Thanks
Surekha

[the_wolverine]

One of the metadata figures is events. It is easy to surpass 5M events.

[Linegod]

You really have over 5 million hosts or sourcetypes?

[Ricapar]

How big can this number get?

I set mine to 5000000 (5 million), and I'm still getting the error.

[LiquidTension]

Thanks for the solution! I just created an app on my deployment server with the necessary override:
[metadata]
maxcount=500000

Deployed it to my search heads and the problem was solved immediately.