issue with transactions

[castle1126]

I had previously posted this question earlier: http://answers.splunk.com/questions/9264/am-i-bumping-into-limits-issue-with-subsearch-results. I've done some deeper digging and I believe I'm having a general issue with transactions.

I've done a simple search over an index for a 15 minute window and come up with 75,000 events returned. When I run a simple search to build the transactions (index=smtp [search index=smtp | fields + messageid] | transaction messageid) I end up receiving the same error:

Error in 'UnifiedSearch': Unable to parse the 'The specified search is too large. Please try to simplify your search.

What can be done to help resolve this issue?

Thanks!

[southeringtonp · Accepted solution]

It doesn't look like the subsearch is really needed here, since all it appears to be doing is making sure that the messageid field is populated.

How about just:

index=smtp messageid=* | transaction messageid

[castle1126]

Thanks much! Doing the search that way worked very nicely...