I can't seem to change maxout setting in limits.conf. I've tried changing every maxout or max_count param I could find but it is not taking effect. I tried changing other variables (like reduce_freq or ttl) and that seemed to work but not maxout or maxtime.
This happens when I run sideview Search of "index=*" and then show results in a table. Here is the search log extract...
06-24-2019 17:51:40.147 INFO dispatchRunner - Search process mode: preforked (first search in process)
06-24-2019 17:51:40.147 INFO dispatchRunner - initing LicenseMgr in search process: nonPro=1
06-24-2019 17:51:40.147 INFO dispatchRunner - registering build time modules, count=1
06-24-2019 17:51:40.147 INFO dispatchRunner - registering search time components of build time module name=vix
06-24-2019 17:51:40.147 INFO dispatchRunner - Splunkd starting (build 67571ef4b87d).
06-24-2019 17:51:40.147 INFO dispatchRunner - System info: Linux, XXX, 3.10.0-957.5.1.el7.x86_64, #1 SMP Wed Dec 19 10:46:58 EST 2018, x86_64.
06-24-2019 17:51:40.148 INFO dispatchRunner - Detected 32 (virtual) CPUs, 16 CPU cores, and 128731MB RAM
06-24-2019 17:51:40.148 INFO dispatchRunner - Maximum number of threads (approximate): 16000
06-24-2019 17:51:40.148 INFO dispatchRunner - Arguments are: "search" "--id=1561413100.2" "--maxbuckets=0" "--ttl=600" "--maxout=10000" "--maxtime=8640000" "--lookups=1" "--reduce_freq=6"
06-24-2019 17:51:40.148 INFO dispatchRunner - Getting search configuration data from: /opt/splunk/etc/modules/parsing/config.xml
06-24-2019 17:51:40.152 INFO KVStoreBulletinBoardManager - MessageHandler:KVSTORE_FAILED removed
06-24-2019 17:51:40.477 INFO DispatchThread - Job truncated due to max_count=10000 reached
In the log above it is limiting results to 10000 .
When I run the search index=_internal on the command line it works perfectly, I can override maxout.
Nothing seems to match 10000. I went through the entire /etc stack and ensured there is no such setting there. Somehow no matter what I do it is picking up this 10000 maxout setting and I have no idea from where. Note, I am using sideview utils - not sure if it matters. Splunk version is 6.5.2 (so it is a bit old) - but this is a self contained UAT instance.