- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Subsearch produced 50000 results, truncating to maxout 50000
Query: index=summary_estore_error_cust report=DelPassError userType=LoyalElite | rex field=raw "(UserId\W*(?\d+))" |
join USERID [search index=splunk_db_connect_cust_data sourcetype=sourceRegular earliest = -24h@h ] | stats values(USERID) as UserId by eventTime
When running the above query, I am getting this message under job section.
[subsearch]: Subsearch produced 50000 results, truncating to maxout 50000.
I have done the required changes in limits.conf and push it to all peers using Cluster Master
[subsearch]
maxout
[join]
subsearch_maxout
still I am seeing the message "[subsearch]: Subsearch produced 50000 results, truncating to maxout 50000." in search head.
Could you please advise if I am missing any config here
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
had | join query, it now works adding also :
[subsearch]
maxout = 700000
[searchresults]
maxresultrows = 700000
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Hi,
Can you try the below search,
index=summary_estore_error_cust report=DelPassError userType=LoyalElite | rex field=raw "(UserId\W*(?\d+))" |
join max=0 USERID [search index=splunk_db_connect_cust_data sourcetype=sourceRegular earliest = -24h@h ] | stats values(USERID) as UserId by eventTime
Sid
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Did anyone ever find a solution to this? i'm having the same issue trying to run the machine learning toolkit against 30 days of data.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
[subsearch]
* This stanza controls subsearch results.
* NOTE: This stanza DOES NOT control subsearch results when a subsearch is called by
commands such as join, append, or appendcols.
* Read more about subsearches in the online documentation:
http://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutsubsearches
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

HI
I am having the same issues, did you get a fix?
Thanks
Robert
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

You said -
//
I have done the required changes in limits.conf and push it to all peers using Cluster Master
[subsearch]
maxout
[join]
subsearch_maxout
//
did you update limits.conf like above?
you have to update -
[join]
subsearch_maxout = <integer>
* Maximum result rows in output from subsearch to join against.
* Default: 50000
Sekar
PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for the help. I did a similar change as you mentioned in limits.conf
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

- after updating the limits conf file, did you restart the splunk service?
- did you update the limits conf file on both search heads and search peers/indexers?
- please confirm using btool that whether the limits.conf configuration got applied or not
Sekar
PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I did restart Indexers and Search Heads
Pushed the changes through Cluster Master, it updated all the indexers .
I have made the changes in Search head as well.
Please find below the btool data.
SearchHead
splunk btool limits list --debug | grep maxout
/app/splunk/etc/apps/search/local/limits.conf subsearch_maxout = 100000
/app/splunk/etc/apps/search/local/limits.conf maxout = 1000000
-bash-4.2$ cat /app/splunk/etc/apps/search/local/limits.conf
[subsearch]
maxout=1000000
[join]
subsearch_maxout = 100000
subsearch_maxtime = 120
subsearch_timeout = 240
Indexer
splunk btool limits list --debug | grep maxout
/app/splunk/etc/slave-apps/asda_all_indexes/local/limits.conf subsearch_maxout = 100000
/app/splunk/etc/slave-apps/asda_all_indexes/local/limits.conf maxout = 1000000
-bash-4.2$ cat /app/splunk/etc/slave-apps/asda_all_indexes/local/limits.conf
[subsearch]
maxout=1000000
[join]
subsearch_maxout = 100000
subsearch_maxtime = 120
subsearch_timeout = 240
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

btool output looks good.. not sure of whats going on..
maybe, after running a search you can click the Job menu and select Inspect Job to open the Search Job Inspector. that might give you some hints.
Sekar
PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

HI
I am having the same issues, did you get a fix?
Thanks
Robert
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Try avoiding join using below alternative query.
(index=summary_estore_error_cust report=DelPassError userType=LoyalElite) OR (index=splunk_db_connect_cust_data sourcetype=sourceRegular earliest = -24h@h) | rex field=_raw "(UserId\W*(?<USERID>\d+))" | stats values(eventTime) as eventTime by USERID | stats values(USERID) as UserId by eventTime
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for the help. This query will not satisfy the requirement. I am trying to find a intersection of two queries.
