Splunk Search

Error while search query executing

Loves-to-Learn Lots

Any idea what this error is. I am getting the desired results with the query but it throws below error while executing

Labels (5)
0 Karma


Hi @harry_123 

Your rex seems simple and straight forward however the limits.conf having match_limit setting which is by default 100K. In your case the limit is exceeding it could be platform level match_limit setting could have been reduced by admin or really your rex is having too many matches ( unless you share the event this can not be confirmed. You can test same in regex101.com). Refer - limits.conf - Splunk Documentation

Have a chat with admin about of limit and check is there local setting that's getting overriding, you can use splunk btool command to verify.


An upvote would be appreciated if it helps!

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...