Hi, when i am running a query, it says sub query has finalized automatically after 30 secs. Where is this configurable? can i mention it in the query for how long it should wait before it is finalized?
Thank you Kristian
There is a setting in limits.conf for this.
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf
The question has also been asked before.
http://splunk-base.splunk.com/answers/6934/subsearch-default-time-range
/kristian
