Is it possible to have a search string so long that it can't be parsed in Splunk 6.0 or higher?

[rroberts]

Is this still a possibility with Splunk 6.0 and higher?

"The search process can't parse the search string. In the search.log"

INFO SearchParse -­ {1758 byte str!}
Meaning : This is a 1.7kb string…really long

[martin_mueller · Accepted solution]

The longest search I've got sitting on my laptop's Splunk 6 is 6kB, through some generous copy&paste I've bumped it up to 20kB and it still runs without a hitch... so if there is a limit then 1.7kB or indeed 17kB isn't it.

Check for other events in search.log, especially more severe ones than INFO. If you find nothing you could post your search for us to take a look at what may be unparseable.

[martin_mueller]

I'm curious, did you manage to find the culprit?

[grijhwani]

1758 bytes is only 1.7kB. But good question!