Splunk Search

What would be a few reasons to limit the subsearch maxout setting in the join stanza instead of letting the memory constraint be the limiting factor?

mschellhouse
Path Finder

We are discussing the subsearch_max configuration setting in limits.conf internally and trying to better understand the benefit to setting a limit? It seems as though the better constraint is search memory mgt as I can use various tuning options ("fields" command immediately comes to mind) to limit the size of subsearch but be over some arbitrary numeric threshold.

valiquet
Contributor

To be able to predict and to now when you will reach or reached the limit.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...