How can I avoid getting error "Events may not be returned in sub-second order due to search memory limits configured in limits.conf:[search]:max_rawsize_perchunk"?

[akawacz]

Hi,

I have got below error message

Events may not be returned in sub-second order due to search memory limits configured in limits.conf:[search]:max_rawsize_perchunk. See search.log for more information.

I have uploaded data into summary index as one batch. I think this caused the issue because _time is as uploaded date.

How can I avoid this error message? What can I change in conf files?

thanks

[woodcock]

How does one "upload data into summary index"?

[Nicolo_Figiani]

Hello there,
The topic you're referring to has been already discussed here: Events may not be returned in sub-second order due to search memory limits configured in limits.conf...

The above answer may give you a hint regarding what you should adjust so to avoid that error message. Hope it helps.

Regards,
N.