Developing for Splunk Enterprise

HTTP 400 Bad Request -- Request exceeds API limits - see limits.conf for details. (Too many documents for a single batch save.)

Hi All,

we are getting " HTTP 400 Bad Request -- Request exceeds API limits - see limits.conf for details. (Too many documents for a single batch save.)" Error from python job.

Batch save is not working fine if records count is more than 200.

I have added below stanzas in local,but not working fine.

[kvstore]
maxqueriesperbatch = 500
max
rowsinmemoryperdump = 1000
maxthreadsperoutputlookup = 10
max
documentsperbatch_save = 500

Please help me out from this.

0 Karma

Splunk Employee
Splunk Employee

What is your H/W specification for the search head?
Have you checked if the search head is running into Out-Of-Memory once the issue happens?

If you still see below Error:
"StateStoreError: 'Batch save to KV store failed with code 400. Error details: Request exceeds API limits - see limits.conf for details. (Batch save size=52439798 too large)' "

You may need to increase the maxsizeperresultmb for the [kvstore] in limits.conf

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf#.5Bkvstore.5D

maxsizeperresultmb =
* The maximum size, in megabytes (MB), of the result that will be
returned for a single query to a collection.
* Default: 50

If you see the error during ITSI operation,
Please see our doc regarding the size limit:

https://docs.splunk.com/Documentation/ITSI/latest/Configure/CreateKPIbasesearches#Increase_the_KV_st...

Hope it help and see how it works for you.

0 Karma

H/W specification for the search head:

  OS   : RedHat 7.5
   Arch : x86_64

   CPU  : 36 x Intel(R) Xeon(R) Platinum 8124M CPU @ 3.00GHz
   RAM  : 68.54 GB

   SELinux is enforcing
0 Karma

No bhai Increase ,but not working.

[httpinput]
max
content_length= 838860800000000

[kvstore]
maxsizeperresultmb =20000

[kvstore]
maxsizeperbatchsave_mb =2000

[kvstore]
maxsizeperbatchresult_mb =2000

0 Karma

Influencer

Hi

Did you have a look at max_content_length Maximum size of HTTP request is specified in limits.conf with this.

0 Karma

Bhai , We Increased maxcontentlength ,but not working .

[httpinput]
max
content_length= 838860800000000

[kvstore]
maxsizeperresultmb =20000

[kvstore]
maxsizeperbatchsave_mb =2000

[kvstore]
maxsizeperbatchresult_mb =2000

0 Karma