Pretty much seems like bug to me, either in product or documentation. You are actually supposed to change:
[format] maxresults = 500
or whatever, as the default subsearch
maxout is already 10000, but that doesn't work.
Update: Okay, it appears that there some missing documentation, both in the online docs and (oddly) in the in-product docs for the
format command. The
format command takes an option
maxresults which defaults to 100 unless otherwise specified (and is separate from the limit in
limits.conf. To make it apply in subsearch, you must use the
format command explicitly (rather than letting it format the subsearch results implicitly, e.g.
sourcetype=zzz [search xxx | fields yy | format maxresults=495 ] instead of
sourcetype=zzz [search xxx | fields yy]