Error when running DQL Query through workflow

[CameronFW]

An error occurred: HTTP Error 431: Request Header Fields Too Large

Query (on a 30m timer):

fetch logs, from:now() - 30m

| filter matchesPhrase(content, "[LATEFILE]") and status == "WARN"

| fields latefile, {host.name, alias: hostname}

The DQL Query doesn't seem to be expensive yet seems to fail randomly throughout the day. I have set the retry to 10x15sec and yet it will still fail all 10.

[sinisa_zubic · Accepted solution]

Hi @CameronFW 

The reason why you're seeing this problem is, that the selection of too many permissions in the authorization settings of workflows can trigger such error. The short term workaround is to only select the permissions really needed ( Workflows > settings > authorization settings). The team is already working on a long-term solution. Unfortunately I can't provide you an ETA yet.

Best,
Sini