Refine your search:

I have one (search1) out of three search heads that is failing to properly execute a fields command, for the following search:

sourcetype="atlas" starttime="11/23/2010:08:00:00" endtime="11/23/2010:08:01:00" index="main" cmd=0x1 request | fields evid, evcode, sid

On search1, the above search the fields command is failing to yield any results. However it works on my search2 and search3 boxes. All search boxes are running the same version/build of Splunk, 4.1.5.

When I switch to the table view I see:

[SimpleResultsTable module] Server reported HTTP status=414 while getting mode=events exceeded max_method_size

The splunk _internal index (index="_internal" source="web" host="sch1*" status=414) shows many lines that look like:

2010-11-23 16:07:06,422 ERROR [4cec572a61198c2550] init:1026 - _getResultRange - error while getting data; status=414 content=exceeded max_method_size

and a few that look like:

2010-11-23 16:00:19,693 ERROR [4cec55938f1a275c90] module:62 - Server reported HTTP status=414 while getting mode=events exceeded max_method_size Traceback (most recent call last): File "/opt/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/controllers/module.py", line 60, in renderModule pageContent = instance.generateResults(**args) File "/opt/splunk/share/splunk/search_mrsparkle/modules/results/SimpleResultsTable.py", line 96, in generateResults fieldNames = [x for x in getattr(job, entity_name).fieldOrder if (not x.startswith('_') or x == TIME_FIELD)] File "/opt/splunk/lib/python2.6/site-packages/splunk/search/init.py", line 1171, in _getFieldOrder outputMode='xml' File "/opt/splunk/lib/python2.6/site-packages/splunk/search/init.py", line 1028, in _getResultRange

I have tried two different browsers (firefox and chrome) with the same results. I have tried restarting splunk, but the error persists.

I can't find any reference to max_method_size in the docs.
Any ideas?

Thanks.

asked 29 Nov '10, 17:26

Jaci's gravatar image

Jaci ♦
8722217
accept rate: 75%

Be the first one to answer this question!
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×221
×81

Asked: 29 Nov '10, 17:26

Seen: 722 times

Last updated: 29 Nov '10, 17:26

Copyright © 2005-2012 Splunk, Inc. All rights reserved.