Splunk Search

How can I avoid browser freeze when searched records are long with no newlines


When I do some searches I get records which are very long and have no newlines. The browser (Firefox in my case) effectively freezes up.

How can I avoid effectively locking up my browser when doing queries that might return such records?

Labels (1)
0 Karma


I've tried adding:

|regex _raw!="^[^\r\n]{512,}"

.. and this has filtered out the long records that result in Splunk freezing my browser.

Would be great if Splunk could fix this browser-killing bug.

0 Karma


A better regular expression is:

|regex _raw!="(?m)^[^\r\n]{512,}"

... for the case where the long line isn't the first line. If you don't know the (?m) flag search for PCRE flags.

Or alternative ignore the anchor altogether (but this may be less performant):

|regex _raw!="[^\r\n]{512,}"

Up to you which you choose.

0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...