|
I have one (search1) out of three search heads that is failing to properly execute a fields command, for the following search: sourcetype="atlas" starttime="11/23/2010:08:00:00" endtime="11/23/2010:08:01:00" index="main" cmd=0x1 request | fields evid, evcode, sid On search1, the above search the fields command is failing to yield any results. However it works on my search2 and search3 boxes. All search boxes are running the same version/build of Splunk, 4.1.5. When I switch to the table view I see: [SimpleResultsTable module] Server reported HTTP status=414 while getting mode=events exceeded max_method_size The splunk _internal index (index="_internal" source="web" host="sch1*" status=414) shows many lines that look like: 2010-11-23 16:07:06,422 ERROR [4cec572a61198c2550] init:1026 - _getResultRange - error while getting data; status=414 content=exceeded max_method_size and a few that look like: 2010-11-23 16:00:19,693 ERROR [4cec55938f1a275c90] module:62 - Server reported HTTP status=414 while getting mode=events exceeded max_method_size Traceback (most recent call last): File "/opt/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/controllers/module.py", line 60, in renderModule pageContent = instance.generateResults(**args) File "/opt/splunk/share/splunk/search_mrsparkle/modules/results/SimpleResultsTable.py", line 96, in generateResults fieldNames = [x for x in getattr(job, entity_name).fieldOrder if (not x.startswith('_') or x == TIME_FIELD)] File "/opt/splunk/lib/python2.6/site-packages/splunk/search/init.py", line 1171, in _getFieldOrder outputMode='xml' File "/opt/splunk/lib/python2.6/site-packages/splunk/search/init.py", line 1028, in _getResultRange I have tried two different browsers (firefox and chrome) with the same results. I have tried restarting splunk, but the error persists. I can't find any reference to max_method_size in the docs. Thanks. |
