Hi,
I have got below error message
Events may not be returned in sub-second order due to search memory limits configured in limits.conf:[search]:max_rawsize_perchunk. See search.log for more information.
I have uploaded data into summary index as one batch. I think this caused the issue because _time is as uploaded date.
How can I avoid this error message? What can I change in conf files?
thanks
How does one "upload data into summary index"?
Hello there,
The topic you're referring to has been already discussed here: Events may not be returned in sub-second order due to search memory limits configured in limits.conf...
The above answer may give you a hint regarding what you should adjust so to avoid that error message. Hope it helps.
Regards,
N.