How to run subSearch run longer than default time

xvxt006 · ‎04-18-2013

Hi, when i am running a query, it says sub query has finalized automatically after 30 secs. Where is this configurable? can i mention it in the query for how long it should wait before it is finalized?

xvxt006 · ‎04-23-2013

Thank you Kristian

kristian_kolb · ‎04-19-2013

There is a setting in limits.conf for this.

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf

The question has also been asked before.

http://splunk-base.splunk.com/answers/6934/subsearch-default-time-range

/kristian

How to run subSearch run longer than default time

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

May 2026 Splunk Expert Sessions: Security & Observability

Join the Conversation

How to run subSearch run longer than default time

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

May 2026 Splunk Expert Sessions: Security & Observability