Error viewing message when trying to view logs in live tail.

Follow

Alan Coler

• January 04, 2022 20:05

I have a very specific query , very similar to what I usually use and I'm getting an error stating:

"Your query is producing too many messages and will cause the session to end. Please add additional metadata fields to your query to make it more specific."

 for this:

_source="MMI_Innovate_WEBAPP" and "5167104_ICON_iBOR"

 

When it  finally runs it shows logs from everything and not just "5167104_ICON_iBOR"

 

Then everything disappears. 

0

• 

  Harinder Bhandari

  • January 19, 2022 20:02

  You can add either of the built-in-metadata fields like _collector, _sourceCategory,_sourceHost or _sourceName to narrow down the scope of the search. This will you finish the search faster. Also, you should run your search for smaller timerange to avoid your query is producing too many messages.

  You can learn about build-in-metadata fields here:

  https://help.sumologic.com/05Search/Get-Started-with-Search/Search-Basics/Built-in-Metadata 

  Hope this helps.

  Thanks.

  0

  Comment actions Permalink

Please sign in to leave a comment.