How to run subSearch run longer than default time


Hi, when i am running a query, it says sub query has finalized automatically after 30 secs. Where is this configurable? can i mention it in the query for how long it should wait before it is finalized?

Tags (1)
0 Karma


Thank you Kristian

0 Karma

Ultra Champion

There is a setting in limits.conf for this.

The question has also been asked before.


0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!