topic Re: [subsearch]: Search auto-finalized after time limit reached (30 seconds). Results may be incomplete. in Splunk Search

[subsearch]: Search auto-finalized after time limit reached (30 seconds). Results may be incomplete.

SamChang — Fri, 27 Aug 2010 11:53:39 GMT

Dear Sir

When I run a long search. The Splunk always reponsd this message.

[subsearch]: Search auto-finalized after time limit reached (30 seconds). Results may be incomplete.

and then ... subsearch's result can't be finished.

How to modify this time limit ???

I have add limits.conf to my apps's local directory

Below is my limits.conf's settings --

[subsearch]
maxtime = 180
timeout = 180

and then .... restart splunk service

and then .... it isn't workable

Do you have other method to fix this issue ?

Below is my search ...

index="wms_summary" search_name="Summary Basic Data Output 01" $Param_API_Name$ 
| `GenerateTimeFields` 
| dedup Week_Number, Request_API_Name, Sub_ID 
| stats min(Event_Time) as Event_Start_Time, max(Event_Time) as Event_End_Time, count(Sub_ID) as Sub_ID_Number by Week_Number, Request_API_Name 
| fields + Event_Start_Time, Event_End_Time, Request_API_Name, Sub_ID_Number 
| `FieldsRename` 
| append 
[search index="wms_summary" search_name="Summary Basic Data Output 01" $Param_API_Name$ 
| stats min(_time) as Convert_Start_Time, max(_time) as Convert_End_Time, values(Request_API_Name) as Request_API_Name, dc(Sub_ID) as Sub_ID_Number 
| convert mktime(Convert_Start_Time) as Unix_Start_Time 
| convert timeformat="%Y/%m/%d" ctime(Unix_Start_Time) as Event_Start_Time 
| convert mktime(Convert_End_Time) as Unix_End_Time 
| convert timeformat="%Y/%m/%d" ctime(Unix_End_Time) as Event_End_Time 
| eval $Param_API_Name$ 
| eval Request_API_Name = if(Request_API_Name == "*", "ALL_Sites", Request_API_Name) 
| fields + Event_Start_Time, Event_End_Time, Request_API_Name, Sub_ID_Number 
| `FieldsRename`]

Re: [subsearch]: Search auto-finalized after time limit reached (30 seconds). Results may be incomplete.

gkanapathy — Fri, 27 Aug 2010 12:46:24 GMT

You can adjust the setting in the limits.conf configuration file.

Re: [subsearch]: Search auto-finalized after time limit reached (30 seconds). Results may be incomplete.

SamChang — Fri, 27 Aug 2010 16:53:47 GMT

I have updated my answer to my question ...

Re: [subsearch]: Search auto-finalized after time limit reached (30 seconds). Results may be incomplete.

gkanapathy — Fri, 27 Aug 2010 21:20:10 GMT

Are you doing this in a subsearch in a search command, or a in join command, or an append command? These each take a different setting.

Re: [subsearch]: Search auto-finalized after time limit reached (30 seconds). Results may be incomplete.

SamChang — Sat, 28 Aug 2010 00:02:04 GMT

I have updated my search to my question

Re: [subsearch]: Search auto-finalized after time limit reached (30 seconds). Results may be incomplete.

bwooden — Thu, 18 Nov 2010 04:12:05 GMT

You can modify the settings that affect subsearch timeouts in limits.conf

-- edit --
It depends. One location to edit (or create) this file would be:

$SPLUNK_HOME/etc/system/local/limits.conf

You may wish to read more about configuration files to learn more. .

Re: [subsearch]: Search auto-finalized after time limit reached (30 seconds). Results may be incomplete.

wyang6 — Thu, 18 Nov 2010 04:15:06 GMT

Sorry but where is that?

Re: [subsearch]: Search auto-finalized after time limit reached (30 seconds). Results may be incomplete.

hjwang — Thu, 09 Jun 2011 03:56:36 GMT

I also have the same problem, modifying the limits.conf still doesn't work, Is this a bug ??

Re: [subsearch]: Search auto-finalized after time limit reached (30 seconds). Results may be incomplete.

lpolo — Fri, 15 Jul 2011 16:54:04 GMT

I have the same problem too. Tuning up the limits.conf file does not fix the problem.

Re: [subsearch]: Search auto-finalized after time limit reached (30 seconds). Results may be incomplete.

ehoward — Wed, 24 Aug 2011 18:30:44 GMT

Same here. Is anyone going to address this question?

Re: [subsearch]: Search auto-finalized after time limit reached (30 seconds). Results may be incomplete.

melting — Wed, 24 Aug 2011 19:43:49 GMT

We have an internal bug filed around this behavior. Please file a case with splunk support to get more information and help us prioritize this issue.

For those of you who changed the limits.conf. The job is most likely still running in the background, take a look at the job manager. I would also expect these searches to work better on the CLI.

Re: [subsearch]: Search auto-finalized after time limit reached (30 seconds). Results may be incomplete.

bhawkins1 — Mon, 14 Nov 2016 16:21:38 GMT

Are there any updates on the status of this internal bug?

Re: [subsearch]: Search auto-finalized after time limit reached (30 seconds). Results may be incomplete.

hongklee — Tue, 21 Mar 2017 17:39:05 GMT

do we have a fix on this issue ? i'm seeing the same issue on a pivot report using the data model. we had modified the limit.conf setting, but it didnt helps. Any advise would be greatly appreciated !!