Splunk Search

Is there a character limit for search queries?

williamsweat
Path Finder

... and can I change the character length or is it hard-coded?

Thanks

Tags (1)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

There is no hard limit, and a search query can be many hundreds or millions of characters long. In practice, you will hit a limit on the browser/UI or a limit in the shell/CLI to be able to pass a search string, well before you reach any limit on search string length. You would have to use the API to be able to pass and create a query string long enough.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

There is no hard limit, and a search query can be many hundreds or millions of characters long. In practice, you will hit a limit on the browser/UI or a limit in the shell/CLI to be able to pass a search string, well before you reach any limit on search string length. You would have to use the API to be able to pass and create a query string long enough.

williamsweat
Path Finder

Thanks! It looks like there was an un-escaped character in the query after all 😛

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Not at 4800 characters. It's more likely there is a non-XML compliant character, e.g., & or < or > that isn't getting escaped.

0 Karma

williamsweat
Path Finder

Are there limits with saved searches? I have a query that's approximately 4800 characters that's giving an XML error

0 Karma
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...