Splunk Search

Why am I getting error "Events may not be returned in sub-second order due to search memory limits configured in limits.conf:[search]:max_rawsize_perchunk"?

daniel333
Builder

All,

I am reading other posts about this error, but what is not clear to me, is my customer still gets 100% of the requested logs. Just slowly?

[Server] Events may not be returned in sub-second order due to search memory limits configured in limits.conf:[search]:max_rawsize_perchunk. See search.log for more information.

sansay
Contributor

The answer by DEAD_BEEF is correct. And the first link to a thorough explanation is the best.
One easy and simple way to get around the problem since version 6.4 is to use sampling.
You can do this by clicking on "No Event Sampling" to select a sampling ratio that fits your needs.
alt text

This is also another awesome way to save your splunk system resources.

DEAD_BEEF
Builder

This question has already been asked before and I know it to be accurately answered. A tldr is that there are a large set of events that exceeds memory usage as defined in limits.conf ( max_mem_usage_mb = 200) which all have the same timestamp. Because of the memory limit, Splunk can't guarantee that they are in perfect sub-second correct order.

You can find much more thorough explanations here and here.

DavidHourani
Super Champion

did you find an answer for this question ? if so can you please post it ?
Thank you.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I'll rephrase: I know that's because of a large number of matching events with the same timestamp. Happy?

JensT
Communicator

I downvoted this post because "guessing" is not really an appropriate type help.

0 Karma

lguinn2
Legend

@JensT In this forum, downvoting is used for answers that are wrong, and especially for those answers that could cause harm if used. I appreciate that you took the time to give your reason for downvoting.

Martin did not pose an answer, he made a suggestion as a comment. His comment is clearly intended to further the diagnosis of the problem. As the question itself is very short, his comment elicits additional information that is needed.

martin_mueller
SplunkTrust
SplunkTrust

I'm guessing they have a large number of matching events with the same timestamp?
If so, Splunk is not guaranteeing perfect ordering as per the message.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...