# Not able to query string when selected timestamp as 30 days in opensearch-dashboards

**URL:** <https://forum.opensearch.org/t/not-able-to-query-string-when-selected-timestamp-as-30-days-in-opensearch-dashboards/17641>\
**Category:** OpenSearch Dashboards\
**Tags:** discuss, troubleshoot\
**Created:** [January 30, 2024, 3:44pm UTC](https://forum.opensearch.org/t/not-able-to-query-string-when-selected-timestamp-as-30-days-in-opensearch-dashboards/17641 "2024-01-30T15:44:20Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![shubtiwa](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/shubtiwa/32/3221_2.png) [@shubtiwa](https://forum.opensearch.org/u/shubtiwa)\
**Post date:** [January 30, 2024, 3:44pm UTC](https://forum.opensearch.org/t/not-able-to-query-string-when-selected-timestamp-as-30-days-in-opensearch-dashboards/17641/1 "2024-01-30T15:44:20Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):

2.7.0

**Describe the issue** :

Searching a string in Opensearch-Dashboard when 30 days are selected, throws a null pointer exception

**Observations**  
If we set the timestamp as today and search a string, we see the logs but  
If we set the timestamp as 30 days or more and search a string, it shows a null pointer

**Logs from Opensearch** :

```auto
java.lang.IllegalArgumentException: transport content length received [698.1mb] exceeded [307.1mb]
        at org.opensearch.transport.TcpTransport.readHeaderBuffer(TcpTransport.java:835) ~[opensearch-2.7.0.jar:2.7.0]
        at org.opensearch.transport.TcpTransport.readMessageLength(TcpTransport.java:790) ~[opensearch-2.7.0.jar:2.7.0]
        at org.opensearch.transport.InboundDecoder.internalDecode(InboundDecoder.java:80) ~[opensearch-2.7.0.jar:2.7.0]
        at org.opensearch.transport.InboundDecoder.decode(InboundDecoder.java:71) ~[opensearch-2.7.0.jar:2.7.0]
        at org.opensearch.transport.InboundPipeline.doHandleBytes(InboundPipeline.java:134) ~[opensearch-2.7.0.jar:2.7.0]
        at org.opensearch.transport.InboundPipeline.handleBytes(InboundPipeline.java:115) ~[opensearch-2.7.0.jar:2.7.0]
        at org.opensearch.transport.netty4.Netty4MessageChannelHandler.channelRead(Netty4MessageChannelHandler.java:94) ~[transport-netty4-client-2.7.0.jar:2.7.0]

```

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [January 31, 2024, 9:52pm UTC](https://forum.opensearch.org/t/not-able-to-query-string-when-selected-timestamp-as-30-days-in-opensearch-dashboards/17641/2 "2024-01-31T21:52:49Z")

</div>

@shubtiwa Do you get the same response when you use an API with curl directly on the OpenSearch node?  
How many documents, roughly, do you expect to see?  
How many nodes in the cluster do you have?