How to increase limit of "The pipeline size limit"?

[ktc78]

Hi all,

I just upgraded splunk enterprise from 8.1.2 to 8.2.6.1
And I found some of big searches return below message when I run them

"Error in 'SearchPipeline': The pipeline size for this search exceeds a search command limit : 340"

I've never seen this message on 8.1.2 before

Could you please guide me 'which conf file stanza should be modified to increase pipeline limit?'

[cklunck]

It appears the limit of 340 commands in a search pipeline is a hard-coded value and cannot be increased.

I was able to find this previous Community post which applies to your situation:

Executed search contains more than 340 commands 

[ktc78]

Thanks you cklunck for your kind reply!

I'm sure that's why I can't find any conf files nor articles about that...

Anyway I'm afraid I haven't read that restrictions in splunk release notes at all 😞

[ktc78]

Below is official answer I got from splunk support team

--- Message ---

The limit is a hidden setting.

We don't recommend our customers to modify it, as searches with hundreds of search commands can cause crashes. 

 To prevent crashes, in 8.2.3 we changed the limit to 340.

 In 9.0.0, we made some more fundamental changes to address the root cause of the crashing, so the limit is set to 1000.

 We would recommend upgrading your Splunk Enterprise instances to 9.0.0 or later.

 [Ref] https://docs.splunk.com/Documentation/Splunk/9.0.0/ReleaseNotes/Fixedissues#:~:text=Searches%20with%...