Is there a limitation in the length of a search?

[patricknguyen]

Hello,

I have a long Splunk search that I continue to add more conditions to each day so it keeps growing. Eventually, when my search starts to reach 25K long, it starts to fail. The browsers (both Firefox and Chrome) get disconnected from Splunk search head and fails every time I run the search. My question is whether any limitation in the search length that I can run on Splunk, and what is the limitation if any?

If there is no limitation, then I wonder if this is relating to browser itself, though I've been trying both Chrome and Firefox and they both fails with the same condition above.

Thanks,
-Patrick

[DalJeanis]

Okay, when your SEARCH gets to 25K long, it seems like you need to be looking for a new data model. Consider (meta)tagging your data with useful subsets of your search criteria.

[gfreitas]

I would suggest creating macros to make the search smaller. It`s very common to have huge searches but using macros to make them smaller. You can use for example a macro inside the other and make things easier for you.

[somesoni2 · Accepted solution]

YOu'll reach your browser limit before you'll reach Splunk's. Try to save your long search as saved search and try to use | savedsearch yoursavedsearchname to run it.

[patricknguyen]

Thank you all for your recommendations. I've been able to do "savedsearch <24K query> | search " to bypass browser limitation and get Splunk to process the search successfully per somesoni2 suggestion.