Splunk Search
Highlighted

Can't get past subsearch limit

Explorer

I seem to be stuck with the 100 result limit for a subsearch. I've changed maxout= to 10000 in limits.conf (and restarted Splunk), but still no luck. Any ideas on what else to try? We are on 4.1.2, btw.

Thanks, Mike

Highlighted

Re: Can't get past subsearch limit

Splunk Employee
Splunk Employee

Pretty much seems like bug to me, either in product or documentation. You are actually supposed to change:

[format]
maxresults = 500

or whatever, as the default subsearch maxout is already 10000, but that doesn't work.

Update: Okay, it appears that there some missing documentation, both in the online docs and (oddly) in the in-product docs for the format command. The format command takes an option maxresults which defaults to 100 unless otherwise specified (and is separate from the limit in limits.conf. To make it apply in subsearch, you must use the format command explicitly (rather than letting it format the subsearch results implicitly, e.g. sourcetype=zzz [search xxx | fields yy | format maxresults=495 ] instead of sourcetype=zzz [search xxx | fields yy]

View solution in original post

Highlighted

Re: Can't get past subsearch limit

Explorer

Thanks for the info. I missed the description for format/maxresults when I was scanning through the limits.conf file.

0 Karma
Highlighted

Re: Can't get past subsearch limit

Explorer

Thanks. Piping through format in the subsearch works.

0 Karma
Highlighted

Re: Can't get past subsearch limit

Splunk Employee
Splunk Employee

updated answer with a solution below

0 Karma