What is the impact on searching when getting a warning that the maxresultrows value in the restapi stanza of limits.conf on a search-head is set to less then the requested ammount?

[transtrophe]

In my situation, the default for maxresultrows is used in the limits merge (set to 50000) and the warning indicates 100000 are being requested.

Don't mind resetting the values across my search-head cluster if that is advised. Just trying to evaluate the impact of this warning on searching. Also, if I should change it, should I go with 100000 or some larger value like 150000.

[kuja]

Glad you are asking the question before just upping it. There are a couple of considerations/thoughts(I am sure there are more) that would need to be thought out.

1. If you were to do this you may end up hurting your performance as you may cause memory ballooning at some point. The limit is there to protect against run away memory consumption.
2. Is it possible to eliminate the join/subsearch that may be causing this? -- This is an assumption that one of these maybe causing your issue but worth asking 🙂

As you suggest this change is a global one and should be mindful of such a change. If it were me, I would start with investigating the possibility of reconstructing the search so as to remove the join/subsearch function if that is indeed what is in the search.

HTH!