Receiving error while using mvexpand

[super_saiyan]

While using the mvexpand command, i am getting the below error.

ERROR - 

command.mvexpand: output will be truncated at 1000 results due to excessive memory usage. Memory threshold of 500 MB as configured in limits.conf /[mvexpand]/max_mem_usage_mb has been reached.

Question 1- How can i resolve the above error ?

Question 2 -  Is there any other alternative command of mvexpand ?

[PickleRick]

You can raise the limits of course to delay the onset of the problem a little, as others already mention. But the question is why do you have such a big mvexpand. If you're mvexpanding original events, maybe it's worth reviewing onboarding of this sourcetype. If it's because you did some huge "stats values" or something similar, maybe you should review your search and try to get to the results another way.

[ITWhisperer · Accepted solution]

mvexpand functionality can be replicated to some extent using makecontinuous

https://community.splunk.com/t5/Splunk-Enterprise/Mutlivalue-Field-Problem-Is-there-any-way-to-do-th...

However, you may still run into memory issues.

The memory issue can be postponed by configuring more memory in limits.conf

[VatsalJagani]

@super_saiyan - Generally you should look at the option of changing your query in such a way that you do not require to use mvexpand. (Avoid multi-valued fields where you expect to have more than 1000 values.)

If not possible, then you can look at the option provided by @ITWhisperer 

I hope this helps!!!