Search: time limit

[wyang6]

[subsearch]: Search auto-finalized after time limit reached (60 seconds). Results may be incomplete.

How can I set/increase the time limit? Thank you.

[svenwendler]

I had the same issue. I fixed it by changing the default settings from

[join]
subsearch_maxout = 50000
subsearch_maxtime = 60
subsearch_timeout = 120

to

[join]
subsearch_maxout = 50000
subsearch_maxtime = 360
subsearch_timeout = 360

in limits.conf

[jmnicolino]

I have the same problem with Search auto-finalized after time limit reached (60 seconds). Results may be incomplete.

I've changed the limit.conf as shown below

[subsearch]

maxout = 10000

maxtime = 200

ttl = 300

but, still having the problem after even restarting the server.

Any else I can do????

[matthew_tiffany]

I don't know if anyone is still reading this, but if you're doing a join it has a separate subsearch maxtime variable that might need to be changed too.

[David · Accepted solution]

I'd take a look at the following links:

• http://www.splunk.com/base/Documentation/latest/User/HowSubsearchesWork#Modify_subsearch_limits_in_l...
• http://answers.splunk.com/questions/6128/subsearch-search-auto-finalized-after-time-limit-reached-30...
• http://www.splunk.com/base/Documentation/latest/admin/Aboutconfigurationfiles