Splunk Search

Is there a limitation in the length of a search?

patricknguyen
Explorer

Hello,

I have a long Splunk search that I continue to add more conditions to each day so it keeps growing. Eventually, when my search starts to reach 25K long, it starts to fail. The browsers (both Firefox and Chrome) get disconnected from Splunk search head and fails every time I run the search. My question is whether any limitation in the search length that I can run on Splunk, and what is the limitation if any?

If there is no limitation, then I wonder if this is relating to browser itself, though I've been trying both Chrome and Firefox and they both fails with the same condition above.

Thanks,
-Patrick

0 Karma
1 Solution

somesoni2
Revered Legend

YOu'll reach your browser limit before you'll reach Splunk's. Try to save your long search as saved search and try to use | savedsearch yoursavedsearchname to run it.

View solution in original post

DalJeanis
SplunkTrust
SplunkTrust

Okay, when your SEARCH gets to 25K long, it seems like you need to be looking for a new data model. Consider (meta)tagging your data with useful subsets of your search criteria.

0 Karma

gfreitas
Builder

I would suggest creating macros to make the search smaller. It`s very common to have huge searches but using macros to make them smaller. You can use for example a macro inside the other and make things easier for you.

0 Karma

somesoni2
Revered Legend

YOu'll reach your browser limit before you'll reach Splunk's. Try to save your long search as saved search and try to use | savedsearch yoursavedsearchname to run it.

View solution in original post

patricknguyen
Explorer

Thank you all for your recommendations. I've been able to do "savedsearch <24K query> | search " to bypass browser limitation and get Splunk to process the search successfully per somesoni2 suggestion.

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.