Error: mvexpand output will be truncated due to excessive memory usage

[erstexas]

I get the above error when running a query. I have increased the RAM and swap space on the system and I still get the error. Are there internal controls for this that I could adjust? I can confirm that Splunk is nowhere near running out of memory and not sure how to fix this so that the results are not truncated.

[khourihan_splun · Accepted solution]

Howdy Tex!

Check out http://docs.splunk.com/Documentation/Splunk/5.0.3/Admin/Limitsconf and check out the max_mem_usage_mb = setting.

You can increase the size to handle larger mvexpand results. Just be sure to make sure you have enough free RAM for the size you choose.

best,
Kyle

[erstexas]

You know, I actually looked through that file and didn't see anything that sounded interesting to fix this. I did not find the above online doc listing it as an optional setting. Thanks. I will experiment with this setting.