https://community.splunk.com/t5/Splunk-Search/Subsearch-in-splunk/m-p/572679#M199600 <P>Hi</P><P>you can try to limit result of subsearch by where, stats, dedup etc, but usually this leads to timeout issue, which is actually same issue as you many results.&nbsp;<BR /><BR /></P><P>The better way is to avoid subsearch like joins with stats etc. There are many examples on answers and great presentations on .conf like&nbsp;<A href="https://conf.splunk.com/files/2019/slides/FNC2751.pdf" target="_blank">https://conf.splunk.com/files/2019/slides/FNC2751.pdf</A></P><P>r. Ismo</P> Wed, 27 Oct 2021 15:31:21 GMT isoutamo 2021-10-27T15:31:21Z https://community.splunk.com/t5/Splunk-Search/Subsearch-in-splunk/m-p/572669#M199596 <P>Is there any way we can add some filter in subsearch savedsearch so that we wont skip any data/records as its limiting the events.<BR />e.g I am using savedsearch under join command, but its limiting the data.<BR /><BR /><BR />Thanks in Advance.&nbsp;</P> Wed, 27 Oct 2021 14:56:43 GMT https://community.splunk.com/t5/Splunk-Search/Subsearch-in-splunk/m-p/572669#M199596 Prachi_Chatur 2021-10-27T14:56:43Z https://community.splunk.com/t5/Splunk-Search/Subsearch-in-splunk/m-p/572679#M199600 <P>Hi</P><P>you can try to limit result of subsearch by where, stats, dedup etc, but usually this leads to timeout issue, which is actually same issue as you many results.&nbsp;<BR /><BR /></P><P>The better way is to avoid subsearch like joins with stats etc. There are many examples on answers and great presentations on .conf like&nbsp;<A href="https://conf.splunk.com/files/2019/slides/FNC2751.pdf" target="_blank">https://conf.splunk.com/files/2019/slides/FNC2751.pdf</A></P><P>r. Ismo</P> Wed, 27 Oct 2021 15:31:21 GMT https://community.splunk.com/t5/Splunk-Search/Subsearch-in-splunk/m-p/572679#M199600 isoutamo 2021-10-27T15:31:21Z