https://community.splunk.com/t5/Splunk-Search/Retrieve-the-Data-from-multiple-searches/m-p/445397#M126338 <P>The append uses subsearch and that has a limit of max rows to return of 50000. Whats your full search? How much data each of the search (summary index search and lookups) contains?</P> Wed, 13 Jun 2018 20:43:28 GMT somesoni2 2018-06-13T20:43:28Z https://community.splunk.com/t5/Splunk-Search/Retrieve-the-Data-from-multiple-searches/m-p/445396#M126337 <P>Hi, I have something like this -<BR /> Search 1 - for media customers<BR /> - Summary Index A - contains data from 20th May till now - for media customers<BR /> - Lookup 1 - contains data from 20-Feb to 20th May<BR /> - Lookup 2 - contains data from 21-Dec to 19th Feb</P> <P>Search 2 - for mobile customers<BR /> Summary Index B - contains data from 20th May till now<BR /> Lookup 1 - contains data from 20-Feb to 20th May<BR /> Lookup 2 - contains data from 21-Dec to 19th Feb</P> <P>Now I have to combine the results of these 2 searches by removing all the duplicates. I am using append command with dedup, limit=0 and all but I am getting this in the Job inspector. what possibly could the the reason for truncating the sub search rows?<BR /> [subsearch] : Search Processor: Subsearch produced 51402 results, truncating max out to 50000</P> Wed, 13 Jun 2018 12:37:50 GMT https://community.splunk.com/t5/Splunk-Search/Retrieve-the-Data-from-multiple-searches/m-p/445396#M126337 Shashank_87 2018-06-13T12:37:50Z https://community.splunk.com/t5/Splunk-Search/Retrieve-the-Data-from-multiple-searches/m-p/445397#M126338 <P>The append uses subsearch and that has a limit of max rows to return of 50000. Whats your full search? How much data each of the search (summary index search and lookups) contains?</P> Wed, 13 Jun 2018 20:43:28 GMT https://community.splunk.com/t5/Splunk-Search/Retrieve-the-Data-from-multiple-searches/m-p/445397#M126338 somesoni2 2018-06-13T20:43:28Z