Hi, I ran into the same problem. Just have a look to https://answers.splunk.com/answers/468312/how-do-i-get-splunk-to-limit-the-windows-file-path.html. If your Splunk instance runs on Windows reducing the path may / should solve yours too. Regards. ... View more

Dear manderson7, I have the same problem than you: .pcap file content is copied into inputs.conf. What shall i do in order to be able to search the .pcap content? Thanks for your explanation. ... View more

Hi, I've found the solution to my problem. I hope it will also solve yours. Solution is to set in the [search] stanza of limits.conf (in etc/system or etc/apps/) the batch_wait_after_end parameter to a value higher than the longest duration of your ldapsearch queries. I had a look to all limit values and it was the only one that was equal to 900 (in seconds, e.g. 15 minutes). ... View more

You gave me the courage to open a new case: #441733. I'll let you know the outcome. Or perhaps a user will answer you before ;-). ... View more

Hi, I have the same behaviour: search is stopped after 900 seconds (with 6.5.1 on Windows 2008 R2 and SA-ldapsearch v2.1.0). I opened case #402460 on 05/10/2016... which I accept to be closed on 29/11 because Splunk support did not find the root cause. Even given that the problem is systematic in our standalone Splunk environment. Let's hope Splunk will take a deeper look now 😉 Emmanuel. ... View more

Thank you Martin for your quick answer, Emmanuel. ... View more