Splunk Search

Is it possible to have a search string so long that it can't be parsed in Splunk 6.0 or higher?

Splunk Employee
Splunk Employee

Is this still a possibility with Splunk 6.0 and higher?

"The search process can't parse the search string. In the search.log"

INFO SearchParse -­ {1758 byte str!}
Meaning : This is a 1.7kb string…really long

1 Solution

SplunkTrust
SplunkTrust

The longest search I've got sitting on my laptop's Splunk 6 is 6kB, through some generous copy&paste I've bumped it up to 20kB and it still runs without a hitch... so if there is a limit then 1.7kB or indeed 17kB isn't it.

Check for other events in search.log, especially more severe ones than INFO. If you find nothing you could post your search for us to take a look at what may be unparseable.

View solution in original post

SplunkTrust
SplunkTrust

The longest search I've got sitting on my laptop's Splunk 6 is 6kB, through some generous copy&paste I've bumped it up to 20kB and it still runs without a hitch... so if there is a limit then 1.7kB or indeed 17kB isn't it.

Check for other events in search.log, especially more severe ones than INFO. If you find nothing you could post your search for us to take a look at what may be unparseable.

View solution in original post

SplunkTrust
SplunkTrust

I'm curious, did you manage to find the culprit?

0 Karma

Motivator

1758 bytes is only 1.7kB. But good question!

0 Karma