topic Re: Why are we getting "[subsearch]: Search auto-finalized after time limit (60 seconds) reached" error? in Splunk Search

Why are we getting "[subsearch]: Search auto-finalized after time limit (60 seconds) reached" error?

ddrillic — Mon, 13 Mar 2017 19:11:24 GMT

We get the error such as -

[subsearch]: Search auto-finalized after time limit(60 seconds) reached.

We changed the following for the search app while we use a different app -

$ cat limits.conf
[search]
# setting for an hour
maxtime = 216000

Any ideas?

Re: Why are we getting "[subsearch]: Search auto-finalized after time limit (60 seconds) reached" error?

DalJeanis — Mon, 13 Mar 2017 19:17:11 GMT

did you restart splunk after changing the configuration?

Re: Why are we getting "[subsearch]: Search auto-finalized after time limit (60 seconds) reached" error?

ddrillic — Mon, 13 Mar 2017 19:23:00 GMT

Oh yeah - we did.

Re: Why are we getting "[subsearch]: Search auto-finalized after time limit (60 seconds) reached" error?

woodcock — Mon, 13 Mar 2017 19:28:08 GMT

You should show your subsearch; there must be something wrong with it taking so long. It needs optimization.

Re: Why are we getting "[subsearch]: Search auto-finalized after time limit (60 seconds) reached" error?

ddrillic — Mon, 13 Mar 2017 19:32:41 GMT

It's a Hunk one - huge data set ; -)

Re: Why are we getting "[subsearch]: Search auto-finalized after time limit (60 seconds) reached" error?

woodcock — Mon, 13 Mar 2017 19:42:37 GMT

One of the very few GOOD reasons to resort to upping the timeout.

Re: Why are we getting "[subsearch]: Search auto-finalized after time limit (60 seconds) reached" error?

woodcock — Mon, 13 Mar 2017 19:44:29 GMT

You could run a scheduled search to pull the hunk data in on a regular basis and then use loadjob in your subsearch to access the hunk data from the scheduled search (or ref if in a dashboard panel).

Re: Why are we getting "[subsearch]: Search auto-finalized after time limit (60 seconds) reached" error?

ddrillic — Mon, 13 Mar 2017 22:21:26 GMT

Very kind @woodcock ; -)

But, you see, why does the error message speak about 60 seconds after we upped the timeout interval to an hour?

Re: Why are we getting "[subsearch]: Search auto-finalized after time limit (60 seconds) reached" error?

ddrillic — Mon, 13 Mar 2017 22:22:04 GMT

Interesting - we should try that...

Re: Why are we getting "[subsearch]: Search auto-finalized after time limit (60 seconds) reached" error?

ddrillic — Mon, 27 Mar 2017 21:57:22 GMT

We ended up having the following in limits.conf -

[subsearch]
maxout = 50000
maxtime = 3600
ttl = 300

[join]
subsearch_maxout = 50000
subsearch_maxtime = 3600
subsearch_timeout = 360

It works!!! ; - )