Splunk Search

Is there a character limit for search queries?

williamsweat
Path Finder

... and can I change the character length or is it hard-coded?

Thanks

Tags (1)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

There is no hard limit, and a search query can be many hundreds or millions of characters long. In practice, you will hit a limit on the browser/UI or a limit in the shell/CLI to be able to pass a search string, well before you reach any limit on search string length. You would have to use the API to be able to pass and create a query string long enough.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

There is no hard limit, and a search query can be many hundreds or millions of characters long. In practice, you will hit a limit on the browser/UI or a limit in the shell/CLI to be able to pass a search string, well before you reach any limit on search string length. You would have to use the API to be able to pass and create a query string long enough.

williamsweat
Path Finder

Thanks! It looks like there was an un-escaped character in the query after all 😛

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Not at 4800 characters. It's more likely there is a non-XML compliant character, e.g., & or < or > that isn't getting escaped.

0 Karma

williamsweat
Path Finder

Are there limits with saved searches? I have a query that's approximately 4800 characters that's giving an XML error

0 Karma
Get Updates on the Splunk Community!

Simplifying the Analyst Experience with Finding-based Detections

    Splunk invites you to an engaging Tech Talk focused on streamlining security operations with ...

[Puzzles] Solve, Learn, Repeat: Word Search

This challenge was first posted on Slack #puzzles channelThis puzzle is based on a letter grid containing ...

[Puzzles] Solve, Learn, Repeat: Advent of Code - Day 4

Advent of CodeIn order to participate in these challenges, you will need to register with the Advent of Code ...