Splunk Search

Search for limit violations in subsearches of saved searches

Dear fellow Splunkers,

I'm running a saved search containing multiple sub searches and writing the results to a summary index.

This search returns varying results because the "subsearch_maxtime" in the limits.conf is set to 60 seconds. When this happens, Splunk logs warnings in the search.log which, unfortunately, is not indexed.

An example of the warning in the search.log is:
- [subsearch]: Search auto-finalized after time limit (60 seconds) reached.

Does anybody know a way to historically search for limit violations/warnings of saved searches?

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!