Error auto-canceled search

[lamnguyentt1]

Dear professional,

I want to get the log size of each service in an index.
This is my search string

index="hcg_oapi_prod"| eval size = len(_raw) | stats sum(size) as rawSize by sourcetype | eval GB = round(rawSize / 1024 / 1024/1024, 2)

But this query string can not be completed and auto-canceled.

Please help me.

[smurf]

Hi,

I think you might be hitting some of the user search limits like the amount of memory it can consume.

I would try to switch from Verbose to Fast or specify the _raw field before your eval.

index="hcg_oapi_prod"
| fields _raw
| eval size = len(_raw)
...

This should substantially speed the search up as it would not try to extract all the fields.