Splunk Search

Is there a character limit for search queries?

Path Finder

... and can I change the character length or is it hard-coded?

Thanks

Tags (1)
1 Solution

Splunk Employee
Splunk Employee

There is no hard limit, and a search query can be many hundreds or millions of characters long. In practice, you will hit a limit on the browser/UI or a limit in the shell/CLI to be able to pass a search string, well before you reach any limit on search string length. You would have to use the API to be able to pass and create a query string long enough.

View solution in original post

Splunk Employee
Splunk Employee

There is no hard limit, and a search query can be many hundreds or millions of characters long. In practice, you will hit a limit on the browser/UI or a limit in the shell/CLI to be able to pass a search string, well before you reach any limit on search string length. You would have to use the API to be able to pass and create a query string long enough.

View solution in original post

Path Finder

Thanks! It looks like there was an un-escaped character in the query after all 😛

0 Karma

Splunk Employee
Splunk Employee

Not at 4800 characters. It's more likely there is a non-XML compliant character, e.g., & or < or > that isn't getting escaped.

0 Karma

Path Finder

Are there limits with saved searches? I have a query that's approximately 4800 characters that's giving an XML error

0 Karma