topic Subsearch timeout is ignoring settings in Splunk Search

Subsearch timeout is ignoring settings

Deecie — Mon, 23 Apr 2012 02:01:17 GMT

I'm trying to run a complex search and I keep getting this message:

[subsearch]: Search auto-finalized after time limit (60 seconds) reached.

However, I have this in etc/system/local/limits.conf:

[subsearch]
maxtime = 600

And for good measure I created etc/apps/myapp/local/limits.conf`:

[subsearch]
maxtime = 600

I've definitely restarted Splunk since making these changes. Is there something I'm missing? Could it be something to do with having nested and chained subsearches?

Re: Subsearch timeout is ignoring settings

sdaniels — Mon, 23 Apr 2012 13:07:23 GMT

This may still be a bug. Best thing is to open up a support case to get this addressed. It also helps prioritize our engineering team.

http://splunk-base.splunk.com/answers/6128/subsearch-search-auto-finalized-after-time-limit-reached-30-seconds-results-may-be-incomplete

Re: Subsearch timeout is ignoring settings

sdaniels — Mon, 23 Apr 2012 13:07:46 GMT

What version are you running?

Re: Subsearch timeout is ignoring settings

MuS — Thu, 17 Jan 2013 14:56:29 GMT

Hi Deecie

this can be 'fixed' by changing the values in limits.conf for stanza [join]

 [join]
 subsearch_maxout = number_of_events
 subsearch_maxtime = max_seconds
 subsearch_timeout = seconds

after that it works just fine.

cheers,

MuS