https://community.splunk.com/t5/Splunk-Search/limits-conf-modify-time-out-search/m-p/540667#M152968 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/223770">@splunkcol</a>&nbsp;</P><P>If your search is auto-finalizing before it completes, you'll need to adjust&nbsp;<SPAN>srchMaxTime for your role in <A href="https://docs.splunk.com/Documentation/Splunk/latest/Admin/authorizeconf" target="_self">authorize.conf</A>. Also review srchTimeWin (maximum time range), srchDiskQuota, and other role-based limits, depending on the errors/messages shown.</SPAN></P> Sat, 20 Feb 2021 19:45:56 GMT tscroggins 2021-02-20T19:45:56Z https://community.splunk.com/t5/Splunk-Search/limits-conf-modify-time-out-search/m-p/540555#M152932 <P>&nbsp;</P><P>I am performing a query to generate a chart.</P><P>The query time range is the previous 7 days, when I use this time range I get the error message that I attach, but when I lower the time to 5 or 4 days if I get the information.</P><P>By discard it is because of the time it is taking, I don't know if I'm wrong but there is some configuration that limits a maximum time in seconds until it generates a take out or cancels it splunk.</P><P>Someone suggested that I review the limits.conf file, but when I review the documentation, I don't see which stanza I should modify.</P><P>I appreciate if someone can guide me</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="splunkcol_0-1613750317894.png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/12983iB6F01FCDD4FC57E9/image-size/large?v=v2&amp;px=999" role="button" title="splunkcol_0-1613750317894.png" alt="splunkcol_0-1613750317894.png" /></span></P><P><A href="https://docs.splunk.com/Documentation/Splunk/8.1.2/Admin/Limitsconf#.5Bsearch.5D" target="_blank" rel="noopener">https://docs.splunk.com/Documentation/Splunk/8.1.2/Admin/Limitsconf#.5Bsearch.5D</A></P> Fri, 19 Feb 2021 16:01:58 GMT https://community.splunk.com/t5/Splunk-Search/limits-conf-modify-time-out-search/m-p/540555#M152932 splunkcol 2021-02-19T16:01:58Z https://community.splunk.com/t5/Splunk-Search/limits-conf-modify-time-out-search/m-p/540667#M152968 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/223770">@splunkcol</a>&nbsp;</P><P>If your search is auto-finalizing before it completes, you'll need to adjust&nbsp;<SPAN>srchMaxTime for your role in <A href="https://docs.splunk.com/Documentation/Splunk/latest/Admin/authorizeconf" target="_self">authorize.conf</A>. Also review srchTimeWin (maximum time range), srchDiskQuota, and other role-based limits, depending on the errors/messages shown.</SPAN></P> Sat, 20 Feb 2021 19:45:56 GMT https://community.splunk.com/t5/Splunk-Search/limits-conf-modify-time-out-search/m-p/540667#M152968 tscroggins 2021-02-20T19:45:56Z