Is the maxout limitation of a subsearch defined as the number of events that can be used or number of rows in the result table of my subsearch?

[HeinzWaescher]

Hi,

is the maxout limitation of a subsearch defined as the number of events that can be used or the number of rows in the resulttable of my subsearch ( e.g. after stats or timechart command). I've seen both descriptions in the docs.

BR

Heinz

[somesoni2 · Accepted solution]

As per the documentation here, maxout attribute defines the no of events in the "output of the subsearch". If you're running a aggregate command in the subsearch, the limit will be applied on the output of the aggregate command, not on the no of rows processed/scanned.

http://docs.splunk.com/Documentation/Splunk/6.1.2/admin/Limitsconf

[HeinzWaescher]

Thank you!