Splunk Search

Subsearch produced 50000 results, truncating to maxout 50000

sureshwalmart
Explorer

Query: index=summary_estore_error_cust report=DelPassError userType=LoyalElite | rex field=raw "(UserId\W*(?\d+))" |
join USERID [search index=splunk_db_connect_cust_data sourcetype=sourceRegular
earliest = -24h@h ] | stats values(USERID) as UserId by eventTime

When running the above query, I am getting this message under job section.

[subsearch]: Subsearch produced 50000 results, truncating to maxout 50000.

I have done the required changes in limits.conf and push it to all peers using Cluster Master

[subsearch]
maxout

[join]
subsearch_maxout

still I am seeing the message "[subsearch]: Subsearch produced 50000 results, truncating to maxout 50000." in search head.

Could you please advise if I am missing any config here

splunkreal
Motivator

had | join query, it now works adding also :

[subsearch]
maxout = 700000

[searchresults]
maxresultrows = 700000

* If this helps, please upvote or accept solution 🙂 *

sdchakraborty
Contributor

Hi,

Can you try the below search,

 index=summary_estore_error_cust report=DelPassError userType=LoyalElite | rex field=raw "(UserId\W*(?\d+))" | 
join max=0 USERID [search index=splunk_db_connect_cust_data sourcetype=sourceRegular earliest = -24h@h ] | stats values(USERID) as UserId by eventTime

Sid

zhatsispgx
Path Finder

Did anyone ever find a solution to this? i'm having the same issue trying to run the machine learning toolkit against 30 days of data.

0 Karma

regriffith
Path Finder

[subsearch]
* This stanza controls subsearch results.
* NOTE: This stanza DOES NOT control subsearch results when a subsearch is called by
commands such as join, append, or appendcols.
* Read more about subsearches in the online documentation:
http://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutsubsearches

robertlynch2020
Motivator

HI

I am having the same issues, did you get a fix?

Thanks
Robert

0 Karma

inventsekar
Ultra Champion

You said -

//
I have done the required changes in limits.conf and push it to all peers using Cluster Master
[subsearch]
maxout

[join]
subsearch_maxout
//

did you update limits.conf like above?

you have to update -

[join]
subsearch_maxout = <integer>
* Maximum result rows in output from subsearch to join against.
* Default: 50000

sureshwalmart
Explorer

Thanks for the help. I did a similar change as you mentioned in limits.conf

inventsekar
Ultra Champion
  1. after updating the limits conf file, did you restart the splunk service?
  2. did you update the limits conf file on both search heads and search peers/indexers?
  3. please confirm using btool that whether the limits.conf configuration got applied or not

sureshwalmart
Explorer

I did restart Indexers and Search Heads
Pushed the changes through Cluster Master, it updated all the indexers .
I have made the changes in Search head as well.

Please find below the btool data.

SearchHead

splunk btool limits list --debug | grep maxout

/app/splunk/etc/apps/search/local/limits.conf subsearch_maxout = 100000
/app/splunk/etc/apps/search/local/limits.conf maxout = 1000000

-bash-4.2$ cat /app/splunk/etc/apps/search/local/limits.conf
[subsearch]
maxout=1000000

[join]
subsearch_maxout = 100000
subsearch_maxtime = 120
subsearch_timeout = 240

Indexer

splunk btool limits list --debug | grep maxout

/app/splunk/etc/slave-apps/asda_all_indexes/local/limits.conf subsearch_maxout = 100000
/app/splunk/etc/slave-apps/asda_all_indexes/local/limits.conf maxout = 1000000

-bash-4.2$ cat /app/splunk/etc/slave-apps/asda_all_indexes/local/limits.conf
[subsearch]
maxout=1000000

[join]
subsearch_maxout = 100000
subsearch_maxtime = 120
subsearch_timeout = 240

inventsekar
Ultra Champion

btool output looks good.. not sure of whats going on..

maybe, after running a search you can click the Job menu and select Inspect Job to open the Search Job Inspector. that might give you some hints.

0 Karma

robertlynch2020
Motivator

HI

I am having the same issues, did you get a fix?

Thanks
Robert

somesoni2
SplunkTrust
SplunkTrust

Try avoiding join using below alternative query.

(index=summary_estore_error_cust report=DelPassError userType=LoyalElite) OR (index=splunk_db_connect_cust_data sourcetype=sourceRegular earliest = -24h@h)  | rex field=_raw "(UserId\W*(?<USERID>\d+))" | stats values(eventTime) as eventTime by USERID | stats values(USERID) as UserId by eventTime

sureshwalmart
Explorer

Thanks for the help. This query will not satisfy the requirement. I am trying to find a intersection of two queries.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...