Splunk Search

Can you help me with a stats command error for limit reached?

mbasharat
Contributor

Hi,

I have a report about hosts and vulnerabilities. It has about 30k hosts with list of vulnerabilities they are affected with and total of vulnerabilities for each host. Query runs fine and report generated is exactly what I need.

Problem is when I reference this report in dashboard. I am not getting all results and seeing below error.

'stats' command: limit for values of field 'vulnerability_id' reached. Some values may have been truncated or ignored.

How do I increase this limit or solve this issue?

I will need the exact configuration file name, location and stanza that needs to be fixed and the value it should have to accommodate larger results.

I have only one development server in the sandbox. Production is a clustered environment, so if there is something that needs to be adjusted, how do I do that in both environments?

Thanks in-advance.
alt text

0 Karma
1 Solution

mbasharat
Contributor

I ended up using values instead of list because value removes duplicates reducing the number of rows yet keeping the distinct count accurate. This resolved my issues until values field's size increase in near or far future. Thanks.

0 Karma

Vijeta
Influencer

@mbasharat You can try |mvexpand Vulnerability_ID|mvexpand Severity| stats dc(Vulnerability_ID) by Severity

mbasharat
Contributor

Hi @ Vijeta,

Did you mean to run your provided query in the dashboard panel which has base search referencing to my report OR to have this in report like below? Below stanza did not return any result in the dashboard panel.

| mvexpand Vulnerability_ID | mvexpand Severity | stats dc(Vulnerability_ID) by Severity

0 Karma

mbasharat
Contributor

I ended up using values instead of list because value removes duplicates reducing the number of rows yet keeping the distinct count accurate. This resolved my issues until values field's size increase in near or far future. Thanks.

0 Karma

Vijeta
Influencer

I was referecing about postprocess search in 2nd panel. Also in second panel it will be better if you do not use base search and write index=sample| stats dc(Vulnerability_ID) as Count by Severity

somesoni2
Revered Legend

What's your stats-search ? I'm assuming you're using a values(.. OR list(.. which creates a multivalued field and getting truncated because of multivalued fields's memory limitation.

mbasharat
Contributor

Hi @somesoni2,

Yes, the report's sample query is:

index=sample
| stats dc(vulnerability_id) AS Count, list(vulnerability_id) AS Vulnerability_ID, list(severity) AS Severity BY host
| lookup DB hostname AS host OUTPUT Ip, Organization
| fillnull value="Unknown"

Also, when I reference report in dashboard panels, all is working as I need, except this error in the question.

Additionally, when I try to do another panel using same report reference in the same dashboard and do
| stats dc(Vulnerability_ID) as Count by Severity,
it is also not breaking it down by severity, instead giving the total count as 5. I would like to break it down by severity as well where count for each severity should be 1 respectively. Seems like issue with count of cell value/s?

The result is in the revised question. Comments are not allowing me to attach screenshot from my local.

Thanks.

0 Karma

mbasharat
Contributor

I ended up using values instead of list because value removes duplicates reducing the number of rows yet keeping the distinct count accurate. This resolved my issues until values field's size increase in near or far future. Thanks.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!