Splunk Search

How to run subSearch run longer than default time

xvxt006
Contributor

Hi, when i am running a query, it says sub query has finalized automatically after 30 secs. Where is this configurable? can i mention it in the query for how long it should wait before it is finalized?

Tags (1)
0 Karma

xvxt006
Contributor

Thank you Kristian

0 Karma

kristian_kolb
Ultra Champion

There is a setting in limits.conf for this.

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf

The question has also been asked before.

http://splunk-base.splunk.com/answers/6934/subsearch-default-time-range

/kristian

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...