Can't get past subsearch limit

Question

I seem to be stuck with the 100 result limit for a subsearch. I've changed maxout= to 10000 in limits.conf (and restarted Splunk), but still no luck. Any ideas on what else to try? We are on 4.1.2, btw.

Thanks, Mike

Accepted Answer

1

Pretty much seems like bug to me, either in product or documentation. You are actually supposed to change:

[format]
maxresults = 500

or whatever, as the default subsearch maxout is already 10000, but that doesn't work.

Update: Okay, it appears that there some missing documentation, both in the online docs and (oddly) in the in-product docs for the format command. The format command takes an option maxresults which defaults to 100 unless otherwise specified (and is separate from the limit in limits.conf. To make it apply in subsearch, you must use the format command explicitly (rather than letting it format the subsearch results implicitly, e.g. sourcetype=zzz [search xxx | fields yy | format maxresults=495 ] instead of sourcetype=zzz [search xxx | fields yy]

link

answered 28 May '10, 12:49

gkanapathy ♦
26.3k●1●6●22
accept rate: 42%

edited 31 May '10, 06:40

Thanks for the info. I missed the description for format/maxresults when I was scanning through the limits.conf file.

(28 May '10, 17:11) msallman

Thanks. Piping through format in the subsearch works.

(04 Jun '10, 13:16) msallman

Thanks. Piping through format in the subsearch works.

(04 Jun '10, 13:18) msallman

Can't get past subsearch limit

Follow this question

Splunk Resources

Related questions