topic Re: Why does my subsearch maxtime setting in limits.conf have no effect? in Splunk Search

Why does my subsearch maxtime setting in limits.conf have no effect?

gesman — Tue, 07 Jul 2015 23:05:29 GMT

I have /my-app/local/limits.conf with the following content:

[subsearch]
maxtime = 600

[join]
subsearch_maxtime = 600
subsearch_timeout = 800

Yet when search finished - job inspector still claims that:

 [subsearch]: Search auto-finalized after time limit (60 seconds) reached.

Does this means the setting is ignored, or does this mean that this message is actually incorrect?

Re: Why does my subsearch maxtime setting in limits.conf have no effect?

martin_mueller — Tue, 07 Jul 2015 23:25:20 GMT

Make sure you've restarted after making the changes, and run these two to check that Splunk understands your configuration:

./bin/splunk cmd btool --debug limits list subsearch
./bin/splunk cmd btool --debug limits list join

Re: Why does my subsearch maxtime setting in limits.conf have no effect?

gesman — Wed, 08 Jul 2015 14:19:19 GMT

These commands shows that Splunk honors the limits i set in limits.conf. Which means that ...time limit (60 seconds) reached. message is a bug?

Although I did experiment by comparing results of two queries - one using subsearch and another one using hardcoded search using values that subsearch suppose to return:
index=x page=hello [search index=x user=joe| dedup ip | fields ip] | stats c - this returned c=150
with:
index=x user=joe | fields ip | dedup ip | mvcombine ip | eval ip="(ip=" + mvjoin(ip, " OR ip=") + ")" | table ip
- this returned fragment of search query: (ip=1.2.3.4 OR ip=5.6.7.8 OR ip=...)
- So i copy/pasted this fragment and rerun main query like this:
index=x page=hello (ip=1.2.3.4 OR ip=5.6.7.8 OR ip=...) | stats c - this returned c=200

Which means query with subsearch still missed something, even with high limits value set?

Re: Why does my subsearch maxtime setting in limits.conf have no effect?

martin_mueller — Wed, 08 Jul 2015 17:13:07 GMT

Side note: Use | format to avoid having to assemble the search string manually.

If you're on 6.2.x, add this to limits.conf:

[search_info]
infocsv_log_level = DEBUG

Then run your search again with the ip-subsearch and look at the debug output at the top of the job inspector. That should present you with a complete list of IPs used for filtering.