Reporting

max search length

hjwang
Contributor

Is splunk having max search length limitation?when i search host="xxx" AND (SRC_IP="xxx OR ...) almost 26000 characters to filter the specific ip zone, the search results can be shown fine, but when generating the report or entering the job management, the splunk will say XMLSyntaxError: Start tag expected, '<' not found, line 1, column 1, it seems likely a char. length problem in parenthesis, any solution to this? we use 4.1.4 version,Thanks

Tags (1)
0 Karma

transamrit
Explorer

Use a lookup table rather than a long list of AND/OR expressions.

0 Karma

hjwang
Contributor

i found when i group this long search command by using eventtype and search with eventtype="xxx", it seems ok, some strange bug?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...