Error after configuration in Splunk

[pacifikn]

Hi All!

I need your help !

After checking that we're receiving logs into splunk mgt, I wanted to do Configuration in splunk, Actually I use to do this without running into the issue, but today I have run into the issue after configuration where I was seeing an error saying:

4 errors occured while the search was executing. Therefore, search results might be incomplete. Hide errors

. [indexer1] Events might not be returned in sub-secoond order due to search memory limits. See search.log for more information. Increase the value of the following limits.conf setting:[search]:max_rawsize_perchunk.

. [indexer3] Events might not be returned in sub-secoond order due to search memory limits. See search.log for more information. Increase the value of the following limits.conf setting:[search]:max_rawsize_perchunk.

. [indexer4] Events might not be returned in sub-secoond order due to search memory limits. See search.log for more information. Increase the value of the following limits.conf setting:[search]:max_rawsize_perchunk.

. [indexer5] Events might not be returned in sub-secoond order due to search memory limits. See search.log for more information. Increase the value of the following limits.conf setting:[search]:max_rawsize_perchunk.

Kindly help me on how ,I can fix this and what is the root cause of this error occur? Thank you in advance!!

[richgalloway]

What did you change before this started?

Have you looked in search.log for more information?

What command or search did you run that resulted in these errors?

[pacifikn]

Dear @richgalloway ,

I was doing configuration in Splunk so that I could index the received logs into Splunk instance, And the error occurred when I tried to check if the logs well indexed well into splunk

I used the same command I often use, index="name of index" host= syslog sender IP

Actually I have done the same way I usual use before, but I've run into the issue,  have you ever experienced/seen such error before, and share with me what the root cause? also can you help me on how I can looks the search.log from Splunk through CLI?

Thank you in advance.