Splunk Search

Subsearch results getting truncated while using join

keerthana_k
Communicator

Hi,

We are currently using join for creating summary index in our application. The search runs on a daily basis for the whole day. However, the results of the sub-search keep getting truncated. We have tried increasing the limits of join in etc/system/local/limits.conf as follows:

[join]
subsearch_maxout = 10000000
subsearch_maxtime = 3600
subsearch_timeout = 3600

In spite of this change, the results still truncated. Can anyone please let me know how to fix this issue.

Thanks,

Keerthana

Tags (2)
0 Karma

Ayn
Legend

There is a hard limit on 10500 results for subsearch output. There's no way around this. Sorry.

0 Karma

keerthana_k
Communicator

I am getting the limit as 50000 and not 10500. Also I read in the documentation that join is not affected by this.

[http://docs.splunk.com/Documentation/Splunk/6.2.0/Search/Aboutsubsearches][1]

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...