Subsearch produced 50000 results, truncating to maxout 50000

[sureshwalmart]

Query: index=summary_estore_error_cust report=DelPassError userType=LoyalElite | rex field=raw "(UserId\W*(?\d+))" |
join USERID [search index=splunk_db_connect_cust_data sourcetype=sourceRegular earliest = -24h@h ] | stats values(USERID) as UserId by eventTime

When running the above query, I am getting this message under job section.

[subsearch]: Subsearch produced 50000 results, truncating to maxout 50000.

I have done the required changes in limits.conf and push it to all peers using Cluster Master

[subsearch]
maxout

[join]
subsearch_maxout

still I am seeing the message "[subsearch]: Subsearch produced 50000 results, truncating to maxout 50000." in search head.

Could you please advise if I am missing any config here

[splunkreal]

had | join query, it now works adding also :

[subsearch]
maxout = 700000

[searchresults]
maxresultrows = 700000

[sdchakraborty]

Hi,

Can you try the below search,

 index=summary_estore_error_cust report=DelPassError userType=LoyalElite | rex field=raw "(UserId\W*(?\d+))" | 
join max=0 USERID [search index=splunk_db_connect_cust_data sourcetype=sourceRegular earliest = -24h@h ] | stats values(USERID) as UserId by eventTime

Sid

[zhatsispgx]

Did anyone ever find a solution to this? i'm having the same issue trying to run the machine learning toolkit against 30 days of data.

[regriffith]

[subsearch]
* This stanza controls subsearch results.
* NOTE: This stanza DOES NOT control subsearch results when a subsearch is called by
commands such as join, append, or appendcols.
* Read more about subsearches in the online documentation:
http://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutsubsearches

[robertlynch2020]

HI

I am having the same issues, did you get a fix?

Thanks
Robert

[inventsekar]

You said -

//
I have done the required changes in limits.conf and push it to all peers using Cluster Master
[subsearch]
maxout

[join]
subsearch_maxout
//

did you update limits.conf like above?

you have to update -

[join]
subsearch_maxout = <integer>
* Maximum result rows in output from subsearch to join against.
* Default: 50000

[sureshwalmart]

Thanks for the help. I did a similar change as you mentioned in limits.conf

[inventsekar]

1. after updating the limits conf file, did you restart the splunk service?
2. did you update the limits conf file on both search heads and search peers/indexers?
3. please confirm using btool that whether the limits.conf configuration got applied or not

[sureshwalmart]

I did restart Indexers and Search Heads
Pushed the changes through Cluster Master, it updated all the indexers .
I have made the changes in Search head as well.

Please find below the btool data.

SearchHead

splunk btool limits list --debug | grep maxout

/app/splunk/etc/apps/search/local/limits.conf subsearch_maxout = 100000
/app/splunk/etc/apps/search/local/limits.conf maxout = 1000000

-bash-4.2$ cat /app/splunk/etc/apps/search/local/limits.conf
[subsearch]
maxout=1000000

[join]
subsearch_maxout = 100000
subsearch_maxtime = 120
subsearch_timeout = 240

Indexer

splunk btool limits list --debug | grep maxout

/app/splunk/etc/slave-apps/asda_all_indexes/local/limits.conf subsearch_maxout = 100000
/app/splunk/etc/slave-apps/asda_all_indexes/local/limits.conf maxout = 1000000

-bash-4.2$ cat /app/splunk/etc/slave-apps/asda_all_indexes/local/limits.conf
[subsearch]
maxout=1000000

[join]
subsearch_maxout = 100000
subsearch_maxtime = 120
subsearch_timeout = 240

[inventsekar]

btool output looks good.. not sure of whats going on..

maybe, after running a search you can click the Job menu and select Inspect Job to open the Search Job Inspector. that might give you some hints.

[robertlynch2020]

HI

I am having the same issues, did you get a fix?

Thanks
Robert

[somesoni2]

Try avoiding join using below alternative query.

(index=summary_estore_error_cust report=DelPassError userType=LoyalElite) OR (index=splunk_db_connect_cust_data sourcetype=sourceRegular earliest = -24h@h)  | rex field=_raw "(UserId\W*(?<USERID>\d+))" | stats values(eventTime) as eventTime by USERID | stats values(USERID) as UserId by eventTime

[sureshwalmart]

Thanks for the help. This query will not satisfy the requirement. I am trying to find a intersection of two queries.