|
I had previously posted this question earlier: http://answers.splunk.com/questions/9264/am-i-bumping-into-limits-issue-with-subsearch-results. I've done some deeper digging and I believe I'm having a general issue with transactions. I've done a simple search over an index for a 15 minute window and come up with 75,000 events returned. When I run a simple search to build the transactions ( Error in 'UnifiedSearch': Unable to parse the 'The specified search is too large. Please try to simplify your search. What can be done to help resolve this issue? Thanks! |
|
It doesn't look like the subsearch is really needed here, since all it appears to be doing is making sure that the messageid field is populated. How about just: Thanks much! Doing the search that way worked very nicely...
(03 Dec '10, 18:09)
castle1126
|
