Splunk Search

Search: time limit

wyang6
Path Finder

[subsearch]: Search auto-finalized after time limit reached (60 seconds). Results may be incomplete.

How can I set/increase the time limit? Thank you.

Tags (1)
1 Solution

svenwendler
Path Finder

I had the same issue. I fixed it by changing the default settings from

[join]
subsearch_maxout = 50000
subsearch_maxtime = 60
subsearch_timeout = 120

to

[join]
subsearch_maxout = 50000
subsearch_maxtime = 360
subsearch_timeout = 360

in limits.conf

jmnicolino
New Member

I have the same problem with Search auto-finalized after time limit reached (60 seconds). Results may be incomplete.

I've changed the limit.conf as shown below

[subsearch]

maxout = 10000

maxtime = 200

ttl = 300

but, still having the problem after even restarting the server.

Any else I can do????

0 Karma

matthew_tiffany
Explorer

I don't know if anyone is still reading this, but if you're doing a join it has a separate subsearch maxtime variable that might need to be changed too.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...