Archive

How to run subSearch run longer than default time

Contributor

Hi, when i am running a query, it says sub query has finalized automatically after 30 secs. Where is this configurable? can i mention it in the query for how long it should wait before it is finalized?

Tags (1)
0 Karma

Contributor

Thank you Kristian

0 Karma

Ultra Champion

There is a setting in limits.conf for this.

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf

The question has also been asked before.

http://splunk-base.splunk.com/answers/6934/subsearch-default-time-range

/kristian

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!