topic Re: Search: time limit in Splunk Search

Search: time limit

wyang6 — Thu, 03 Mar 2011 03:31:22 GMT

[subsearch]: Search auto-finalized after time limit reached (60 seconds). Results may be incomplete.

How can I set/increase the time limit? Thank you.

Re: Search: time limit

David — Thu, 03 Mar 2011 03:38:47 GMT

I'd take a look at the following links:

Re: Search: time limit

jmnicolino — Fri, 20 May 2011 18:21:52 GMT

I have the same problem with Search auto-finalized after time limit reached (60 seconds). Results may be incomplete.

I've changed the limit.conf as shown below

[subsearch]

maxout = 10000

maxtime = 200

ttl = 300

but, still having the problem after even restarting the server.

Any else I can do????

Re: Search: time limit

matthew_tiffany — Mon, 03 Jun 2013 17:44:46 GMT

I don't know if anyone is still reading this, but if you're doing a join it has a separate subsearch maxtime variable that might need to be changed too.

Re: Search: time limit

svenwendler — Wed, 25 Sep 2013 23:28:05 GMT

I had the same issue. I fixed it by changing the default settings from

[join]
subsearch_maxout = 50000
subsearch_maxtime = 60
subsearch_timeout = 120

[join]
subsearch_maxout = 50000
subsearch_maxtime = 360
subsearch_timeout = 360

in limits.conf