Archive

Metadata results from this peer are incomplete: the peer has over 100000 entries

Engager

When I go to the dashboard_live I get the following warning:

Metadata results from this peer are incomplete: the peer has over 100000 entries (see parameter maxcount under the [metadata] stanza in limits.conf), and it will only return metadata information for the first 100000 entries that it encountered. (sid=rt_1365991104.36)

What does this mean exactly and how can I fix it? I can see when I do a ps on the server that there are a few processes running for a long time with the sid in the warning. Which default search are they?

Thanks!

Tags (1)
1 Solution

Path Finder

http://docs.splunk.com/Documentation/Splunk/5.0.2/ReleaseNotes/KnownIssues

"Metadata results from this peer are incomplete: the peer has over 100000 entries" message in the summary dashboard in large environment (SPL-58112). To work around this issue, increase the value of [metadata] maxcount=500000 in limits.conf."

View solution in original post

Path Finder

http://docs.splunk.com/Documentation/Splunk/5.0.2/ReleaseNotes/KnownIssues

"Metadata results from this peer are incomplete: the peer has over 100000 entries" message in the summary dashboard in large environment (SPL-58112). To work around this issue, increase the value of [metadata] maxcount=500000 in limits.conf."

View solution in original post

Path Finder

Hi,

I have increased the maxcount value to 5000000 but still I am getting the error

"Metadata results may be incomplete: 5000000 entries have been received from all peers (see parameter maxcount under the [metadata] stanza in limits.conf), and this search will not return metadata information for any more entries. (sid=rt_1427108700.117555)"

Please suggest a permanent fix for this issue.

Thanks
Surekha

0 Karma

Champion

One of the metadata figures is events. It is easy to surpass 5M events.

0 Karma

Path Finder

You really have over 5 million hosts or sourcetypes?

0 Karma

Communicator

How big can this number get?

I set mine to 5000000 (5 million), and I'm still getting the error.

0 Karma

Path Finder

Thanks for the solution! I just created an app on my deployment server with the necessary override:
[metadata]
maxcount=500000

Deployed it to my search heads and the problem was solved immediately.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!