https://community.splunk.com/t5/Splunk-Search/Does-multisearch-suffer-from-subsearch-limits/m-p/137905#M184773 <P>Thank you for the note!</P> Tue, 13 Aug 2019 17:08:50 GMT cleavesn 2019-08-13T17:08:50Z https://community.splunk.com/t5/Splunk-Search/Does-multisearch-suffer-from-subsearch-limits/m-p/137903#M184771 Sun, 07 Jun 2015 14:54:50 GMT https://community.splunk.com/t5/Splunk-Search/Does-multisearch-suffer-from-subsearch-limits/m-p/137903#M184771 marcusnilssonmr 2015-06-07T14:54:50Z https://community.splunk.com/t5/Splunk-Search/Does-multisearch-suffer-from-subsearch-limits/m-p/137904#M184772 <P>That is a very good question! So let's figure it out. First create a <CODE>test</CODE> index in your splunk instance. Next we can use <A href="http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/gentimes">gentimes</A> to create 259,200 events (number of seconds in 3 days) and use a summary indexing command <A href="http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Collect">collect</A> to populate that index like so: </P> <PRE><CODE>| gentimes increment=1s start=-3 end=0 | eval _raw=strftime(starttime,"%FT%TZ").", one=1" | fields + _raw | collect index=test </CODE></PRE> <P>Now we can use <A href="http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/multisearch">multisearch</A> to test our theory. If we are subject to the <A href="http://docs.splunk.com/Documentation/Splunk/6.2.3/admin/Limitsconf">subsearch maxout limit of 10,000 results</A>, then the following search should only pull back 30,000 events:</P> <PRE><CODE>| multisearch [search index=test earliest=-7d@d] [search index=test earliest=-7d@d] [search index=test earliest=-7d@d] </CODE></PRE> <P>And we pull back 777,600 events. Thus multisearch must not be subject to the standard subsearch limit.</P> Sun, 07 Jun 2015 17:07:05 GMT https://community.splunk.com/t5/Splunk-Search/Does-multisearch-suffer-from-subsearch-limits/m-p/137904#M184772 acharlieh 2015-06-07T17:07:05Z https://community.splunk.com/t5/Splunk-Search/Does-multisearch-suffer-from-subsearch-limits/m-p/137905#M184773 <P>Thank you for the note!</P> Tue, 13 Aug 2019 17:08:50 GMT https://community.splunk.com/t5/Splunk-Search/Does-multisearch-suffer-from-subsearch-limits/m-p/137905#M184773 cleavesn 2019-08-13T17:08:50Z