I had previously posted this question earlier: http://answers.splunk.com/questions/9264/am-i-bumping-into-limits-issue-with-subsearch-results. I've done some deeper digging and I believe I'm having a general issue with transactions.
I've done a simple search over an index for a 15 minute window and come up with 75,000 events returned. When I run a simple search to build the transactions (
Error in 'UnifiedSearch': Unable to parse the 'The specified search is too large. Please try to simplify your search.
What can be done to help resolve this issue?
It doesn't look like the subsearch is really needed here, since all it appears to be doing is making sure that the messageid field is populated.
How about just:
answered 03 Dec '10, 16:38