Splunk Search

Is there a character limit for search queries?

williamsweat
Path Finder

... and can I change the character length or is it hard-coded?

Thanks

Tags (1)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

There is no hard limit, and a search query can be many hundreds or millions of characters long. In practice, you will hit a limit on the browser/UI or a limit in the shell/CLI to be able to pass a search string, well before you reach any limit on search string length. You would have to use the API to be able to pass and create a query string long enough.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

There is no hard limit, and a search query can be many hundreds or millions of characters long. In practice, you will hit a limit on the browser/UI or a limit in the shell/CLI to be able to pass a search string, well before you reach any limit on search string length. You would have to use the API to be able to pass and create a query string long enough.

williamsweat
Path Finder

Thanks! It looks like there was an un-escaped character in the query after all 😛

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Not at 4800 characters. It's more likely there is a non-XML compliant character, e.g., & or < or > that isn't getting escaped.

0 Karma

williamsweat
Path Finder

Are there limits with saved searches? I have a query that's approximately 4800 characters that's giving an XML error

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...