Splunk Search

Subsearch produced 50000 results, truncating to maxout 50000

sureshwalmart
Explorer

Query: index=summary_estore_error_cust report=DelPassError userType=LoyalElite | rex field=raw "(UserId\W*(?\d+))" |
join USERID [search index=splunk_db_connect_cust_data sourcetype=sourceRegular
earliest = -24h@h ] | stats values(USERID) as UserId by eventTime

When running the above query, I am getting this message under job section.

[subsearch]: Subsearch produced 50000 results, truncating to maxout 50000.

I have done the required changes in limits.conf and push it to all peers using Cluster Master

[subsearch]
maxout

[join]
subsearch_maxout

still I am seeing the message "[subsearch]: Subsearch produced 50000 results, truncating to maxout 50000." in search head.

Could you please advise if I am missing any config here

splunkreal
Motivator

had | join query, it now works adding also :

[subsearch]
maxout = 700000

[searchresults]
maxresultrows = 700000

* If this helps, please upvote or accept solution 🙂 *

sdchakraborty
Contributor

Hi,

Can you try the below search,

 index=summary_estore_error_cust report=DelPassError userType=LoyalElite | rex field=raw "(UserId\W*(?\d+))" | 
join max=0 USERID [search index=splunk_db_connect_cust_data sourcetype=sourceRegular earliest = -24h@h ] | stats values(USERID) as UserId by eventTime

Sid

zhatsispgx
Path Finder

Did anyone ever find a solution to this? i'm having the same issue trying to run the machine learning toolkit against 30 days of data.

0 Karma

regriffith
Path Finder

[subsearch]
* This stanza controls subsearch results.
* NOTE: This stanza DOES NOT control subsearch results when a subsearch is called by
commands such as join, append, or appendcols.
* Read more about subsearches in the online documentation:
http://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutsubsearches

robertlynch2020
Motivator

HI

I am having the same issues, did you get a fix?

Thanks
Robert

0 Karma

inventsekar
Ultra Champion

You said -

//
I have done the required changes in limits.conf and push it to all peers using Cluster Master
[subsearch]
maxout

[join]
subsearch_maxout
//

did you update limits.conf like above?

you have to update -

[join]
subsearch_maxout = <integer>
* Maximum result rows in output from subsearch to join against.
* Default: 50000

sureshwalmart
Explorer

Thanks for the help. I did a similar change as you mentioned in limits.conf

inventsekar
Ultra Champion
  1. after updating the limits conf file, did you restart the splunk service?
  2. did you update the limits conf file on both search heads and search peers/indexers?
  3. please confirm using btool that whether the limits.conf configuration got applied or not

sureshwalmart
Explorer

I did restart Indexers and Search Heads
Pushed the changes through Cluster Master, it updated all the indexers .
I have made the changes in Search head as well.

Please find below the btool data.

SearchHead

splunk btool limits list --debug | grep maxout

/app/splunk/etc/apps/search/local/limits.conf subsearch_maxout = 100000
/app/splunk/etc/apps/search/local/limits.conf maxout = 1000000

-bash-4.2$ cat /app/splunk/etc/apps/search/local/limits.conf
[subsearch]
maxout=1000000

[join]
subsearch_maxout = 100000
subsearch_maxtime = 120
subsearch_timeout = 240

Indexer

splunk btool limits list --debug | grep maxout

/app/splunk/etc/slave-apps/asda_all_indexes/local/limits.conf subsearch_maxout = 100000
/app/splunk/etc/slave-apps/asda_all_indexes/local/limits.conf maxout = 1000000

-bash-4.2$ cat /app/splunk/etc/slave-apps/asda_all_indexes/local/limits.conf
[subsearch]
maxout=1000000

[join]
subsearch_maxout = 100000
subsearch_maxtime = 120
subsearch_timeout = 240

inventsekar
Ultra Champion

btool output looks good.. not sure of whats going on..

maybe, after running a search you can click the Job menu and select Inspect Job to open the Search Job Inspector. that might give you some hints.

0 Karma

robertlynch2020
Motivator

HI

I am having the same issues, did you get a fix?

Thanks
Robert

somesoni2
SplunkTrust
SplunkTrust

Try avoiding join using below alternative query.

(index=summary_estore_error_cust report=DelPassError userType=LoyalElite) OR (index=splunk_db_connect_cust_data sourcetype=sourceRegular earliest = -24h@h)  | rex field=_raw "(UserId\W*(?<USERID>\d+))" | stats values(eventTime) as eventTime by USERID | stats values(USERID) as UserId by eventTime

sureshwalmart
Explorer

Thanks for the help. This query will not satisfy the requirement. I am trying to find a intersection of two queries.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...