Splunk Search

Is it possible to have a search string so long that it can't be parsed in Splunk 6.0 or higher?

rroberts
Splunk Employee
Splunk Employee

Is this still a possibility with Splunk 6.0 and higher?

"The search process can't parse the search string. In the search.log"

INFO SearchParse -­ {1758 byte str!}
Meaning : This is a 1.7kb string…really long

1 Solution

martin_mueller
SplunkTrust
SplunkTrust

The longest search I've got sitting on my laptop's Splunk 6 is 6kB, through some generous copy&paste I've bumped it up to 20kB and it still runs without a hitch... so if there is a limit then 1.7kB or indeed 17kB isn't it.

Check for other events in search.log, especially more severe ones than INFO. If you find nothing you could post your search for us to take a look at what may be unparseable.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

The longest search I've got sitting on my laptop's Splunk 6 is 6kB, through some generous copy&paste I've bumped it up to 20kB and it still runs without a hitch... so if there is a limit then 1.7kB or indeed 17kB isn't it.

Check for other events in search.log, especially more severe ones than INFO. If you find nothing you could post your search for us to take a look at what may be unparseable.

martin_mueller
SplunkTrust
SplunkTrust

I'm curious, did you manage to find the culprit?

0 Karma

grijhwani
Motivator

1758 bytes is only 1.7kB. But good question!

0 Karma
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...