Splunk Search

Error while search query executing

Loves-to-Learn Lots

Any idea what this error is. I am getting the desired results with the query but it throws below error while executing

Labels (5)
0 Karma


Hi @harry_123 

Your rex seems simple and straight forward however the limits.conf having match_limit setting which is by default 100K. In your case the limit is exceeding it could be platform level match_limit setting could have been reduced by admin or really your rex is having too many matches ( unless you share the event this can not be confirmed. You can test same in regex101.com). Refer - limits.conf - Splunk Documentation

Have a chat with admin about of limit and check is there local setting that's getting overriding, you can use splunk btool command to verify.


An upvote would be appreciated if it helps!

0 Karma
Get Updates on the Splunk Community!

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...

How to Troubleshoot our Splunk HEC Endpoint

This blog post is part of an ongoing series on OpenTelemetry. In this blog post, we will explore the best way ...