Dear fellow Splunkers,
I'm running a saved search containing multiple sub searches and writing the results to a summary index.
This search returns varying results because the "subsearch_maxtime" in the limits.conf is set to 60 seconds. When this happens, Splunk logs warnings in the search.log which, unfortunately, is not indexed.
An example of the warning in the search.log is:
- [subsearch]: Search auto-finalized after time limit (60 seconds) reached.
Does anybody know a way to historically search for limit violations/warnings of saved searches?
