Subsearch limit is 10,500 results ?

[oreni]

The subsearch documentation says the following:

maxout =
* Maximum number of results to return from a subsearch.
* This number cannot be greater than or equal to 10500.

What if choose not to modify limits.conf ? will I still get a result set that isn't greater than 10500 ?

What I'm trying to understand is whether a subsearch is limited by default.

Thanks.

[mzorzi · Accepted solution]

A subsearch is limited by default and it is meant to be used for small searches.

You can find more useful on this page:

http://docs.splunk.com/Documentation/Splunk/4.2.3/User/HowSubsearchesWork