Splunk Search

What would be a few reasons to limit the subsearch maxout setting in the join stanza instead of letting the memory constraint be the limiting factor?

mschellhouse
Path Finder

We are discussing the subsearch_max configuration setting in limits.conf internally and trying to better understand the benefit to setting a limit? It seems as though the better constraint is search memory mgt as I can use various tuning options ("fields" command immediately comes to mind) to limit the size of subsearch but be over some arbitrary numeric threshold.

valiquet
Contributor

To be able to predict and to now when you will reach or reached the limit.

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...