Splunk Search

Error auto-canceled search

lamnguyentt1
Explorer

Dear professional,

I want to get the log size of each service in an index.
This is my search string


index="hcg_oapi_prod"| eval size = len(_raw) | stats sum(size) as rawSize by sourcetype | eval GB = round(rawSize / 1024 / 1024/1024, 2)

lamnguyentt1_0-1651137456325.png

 

But this query string can not be completed and auto-canceled.

lamnguyentt1_1-1651137487499.png

 

Please help me.

0 Karma

smurf
Communicator

Hi,

I think you might be hitting some of the user search limits like the amount of memory it can consume.

I would try to switch from Verbose to Fast or specify the _raw field before your eval.

index="hcg_oapi_prod"
| fields _raw
| eval size = len(_raw)
...

This should substantially speed the search up as it would not try to extract all the fields.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...