Can't get past subsearch limit

[msallman]

I seem to be stuck with the 100 result limit for a subsearch. I've changed maxout= to 10000 in limits.conf (and restarted Splunk), but still no luck. Any ideas on what else to try? We are on 4.1.2, btw.

Thanks, Mike

[gkanapathy]

updated answer with a solution below

[gkanapathy · Accepted solution]

Pretty much seems like bug to me, either in product or documentation. You are actually supposed to change:

[format]
maxresults = 500

or whatever, as the default subsearch maxout is already 10000, but that doesn't work.

Update: Okay, it appears that there some missing documentation, both in the online docs and (oddly) in the in-product docs for the format command. The format command takes an option maxresults which defaults to 100 unless otherwise specified (and is separate from the limit in limits.conf. To make it apply in subsearch, you must use the format command explicitly (rather than letting it format the subsearch results implicitly, e.g. sourcetype=zzz [search xxx | fields yy | format maxresults=495 ] instead of sourcetype=zzz [search xxx | fields yy]

[JohnMurphyAus]

12 Years later, still the only solution I have managed to find!

Thank you 🙂

[msallman]

Thanks. Piping through format in the subsearch works.

[msallman]

Thanks for the info. I missed the description for format/maxresults when I was scanning through the limits.conf file.