How to adjust the subsearch auto-finalized time limit

[AntonioM]

Hello I currently have 3 searches that I am appending together. When I run the search I get the message "[subsearch]: Search auto-finalized after time limit (30 seconds) reached."

How do I adjust the time limit to be more than 30 seconds. One of my searches lasts about 28min so that's how long I would need the time-limit to be. I tried configuring the limits.conf but it still auto-finalizes after 30 seconds. I put this in the limits.conf:

[subsearch]
maxtime=1680

Any ideas?

Thanks,

AntonioM

[neklov_splunk]

Hi, The default value for this is 60 seconds if you leave it blank, have you tried that? And also what version of Splunk are you running?

[AntonioM]

Hey neklov_splunk thanks for your reply. I am running version 4.2.4. I have tried modifying the limits.conf to 1680 seconds but I would still get that message. I even set it to its default of 60 but it still wont work.