Hi,
We are currently using join for creating summary index in our application. The search runs on a daily basis for the whole day. However, the results of the sub-search keep getting truncated. We have tried increasing the limits of join in etc/system/local/limits.conf as follows:
[join]
subsearch_maxout = 10000000
subsearch_maxtime = 3600
subsearch_timeout = 3600
In spite of this change, the results still truncated. Can anyone please let me know how to fix this issue.
Thanks,
Keerthana
There is a hard limit on 10500 results for subsearch output. There's no way around this. Sorry.
I am getting the limit as 50000 and not 10500. Also I read in the documentation that join is not affected by this.
[http://docs.splunk.com/Documentation/Splunk/6.2.0/Search/Aboutsubsearches][1]