mvexpand truncate result because of exceed 500MB memory usage

[ahmedhassanean]

Dears,

i have splunk 6.3.3 and i am using query that have command mvexpand but mvexpand truncate result because of exceed 500MB memory usage i have found on splunk doc of version 5 that i can edit limits.conf value of max_memory_usage to higher value than 500MB but it's not working in version 6.3 and also this option not exist in default configuration of limits.conf

please advise

[vasanthmss]

You need to increase the size in limits.conf or optimize your search like reduce the data size that needs to be processed by search intervals

[somesoni2]

In 6.3.3, the attribute that you're interested in is called max_mem_usage_mb.

[ahmedhassanean]

yes it's the same as 5.0.3 but search query still truncate at 500 MB

[vasanthmss]

What is the search interval you are running now? If possible share some sample data along with search