Hi All!
I need your help !
After checking that we're receiving logs into splunk mgt, I wanted to do Configuration in splunk, Actually I use to do this without running into the issue, but today I have run into the issue after configuration where I was seeing an error saying:
4 errors occured while the search was executing. Therefore, search results might be incomplete. Hide errors
. [indexer1] Events might not be returned in sub-secoond order due to search memory limits. See search.log for more information. Increase the value of the following limits.conf setting:[search]:max_rawsize_perchunk.
. [indexer3] Events might not be returned in sub-secoond order due to search memory limits. See search.log for more information. Increase the value of the following limits.conf setting:[search]:max_rawsize_perchunk.
. [indexer4] Events might not be returned in sub-secoond order due to search memory limits. See search.log for more information. Increase the value of the following limits.conf setting:[search]:max_rawsize_perchunk.
. [indexer5] Events might not be returned in sub-secoond order due to search memory limits. See search.log for more information. Increase the value of the following limits.conf setting:[search]:max_rawsize_perchunk.
Kindly help me on how ,I can fix this and what is the root cause of this error occur? Thank you in advance!!
What did you change before this started?
Have you looked in search.log for more information?
What command or search did you run that resulted in these errors?
Dear @richgalloway ,
I was doing configuration in Splunk so that I could index the received logs into Splunk instance, And the error occurred when I tried to check if the logs well indexed well into splunk
I used the same command I often use, index="name of index" host= syslog sender IP
Actually I have done the same way I usual use before, but I've run into the issue, have you ever experienced/seen such error before, and share with me what the root cause? also can you help me on how I can looks the search.log from Splunk through CLI?
Thank you in advance.