Why am I getting error "Events may not be returned in sub-second order due to search memory limits configured in limits.conf:[search]:max_rawsize_perchunk"?

[daniel333]

All,

I am reading other posts about this error, but what is not clear to me, is my customer still gets 100% of the requested logs. Just slowly?

[Server] Events may not be returned in sub-second order due to search memory limits configured in limits.conf:[search]:max_rawsize_perchunk. See search.log for more information.

[sansay]

The answer by DEAD_BEEF is correct. And the first link to a thorough explanation is the best.
One easy and simple way to get around the problem since version 6.4 is to use sampling.
You can do this by clicking on "No Event Sampling" to select a sampling ratio that fits your needs.

This is also another awesome way to save your splunk system resources.

[DEAD_BEEF]

This question has already been asked before and I know it to be accurately answered. A tldr is that there are a large set of events that exceeds memory usage as defined in limits.conf ( max_mem_usage_mb = 200) which all have the same timestamp. Because of the memory limit, Splunk can't guarantee that they are in perfect sub-second correct order.

You can find much more thorough explanations here and here.

[DavidHourani]

did you find an answer for this question ? if so can you please post it ?
Thank you.

[martin_mueller]

I'll rephrase: I know that's because of a large number of matching events with the same timestamp. Happy?

[JensT]

I downvoted this post because "guessing" is not really an appropriate type help.

[lguinn2]

@JensT In this forum, downvoting is used for answers that are wrong, and especially for those answers that could cause harm if used. I appreciate that you took the time to give your reason for downvoting.

Martin did not pose an answer, he made a suggestion as a comment. His comment is clearly intended to further the diagnosis of the problem. As the question itself is very short, his comment elicits additional information that is needed.

[martin_mueller]

I'm guessing they have a large number of matching events with the same timestamp?
If so, Splunk is not guaranteeing perfect ordering as per the message.