Splunk Search
Highlighted

Subsearch produced 50000 results, truncating to maxout 50000

Explorer

Query: index=summaryestoreerrorcust report=DelPassError userType=LoyalElite | rex field=raw "(UserId\W*(?\d+))" |
join USERID [search index=splunkdbconnectcustdata sourcetype=sourceRegular_ earliest = -24h@h ] | stats values(USERID) as UserId by eventTime

When running the above query, I am getting this message under job section.

[subsearch]: Subsearch produced 50000 results, truncating to maxout 50000.

I have done the required changes in limits.conf and push it to all peers using Cluster Master

[subsearch]
maxout

[join]
subsearch_maxout

still I am seeing the message "[subsearch]: Subsearch produced 50000 results, truncating to maxout 50000." in search head.

Could you please advise if I am missing any config here

Highlighted

Re: Subsearch produced 50000 results, truncating to maxout 50000

SplunkTrust
SplunkTrust

Try avoiding join using below alternative query.

(index=summary_estore_error_cust report=DelPassError userType=LoyalElite) OR (index=splunk_db_connect_cust_data sourcetype=sourceRegular earliest = -24h@h)  | rex field=_raw "(UserId\W*(?<USERID>\d+))" | stats values(eventTime) as eventTime by USERID | stats values(USERID) as UserId by eventTime
0 Karma
Highlighted

Re: Subsearch produced 50000 results, truncating to maxout 50000

Explorer

Thanks for the help. This query will not satisfy the requirement. I am trying to find a intersection of two queries.

0 Karma
Highlighted

Re: Subsearch produced 50000 results, truncating to maxout 50000

Champion

You said -

//
I have done the required changes in limits.conf and push it to all peers using Cluster Master
[subsearch]
maxout

[join]
subsearch_maxout
//

did you update limits.conf like above?

you have to update -

[join]
subsearch_maxout = <integer>
* Maximum result rows in output from subsearch to join against.
* Default: 50000
0 Karma
Highlighted

Re: Subsearch produced 50000 results, truncating to maxout 50000

Explorer

Thanks for the help. I did a similar change as you mentioned in limits.conf

0 Karma
Highlighted

Re: Subsearch produced 50000 results, truncating to maxout 50000

Champion
  1. after updating the limits conf file, did you restart the splunk service?
  2. did you update the limits conf file on both search heads and search peers/indexers?
  3. please confirm using btool that whether the limits.conf configuration got applied or not
Highlighted

Re: Subsearch produced 50000 results, truncating to maxout 50000

Explorer

I did restart Indexers and Search Heads
Pushed the changes through Cluster Master, it updated all the indexers .
I have made the changes in Search head as well.

Please find below the btool data.

SearchHead

splunk btool limits list --debug | grep maxout

/app/splunk/etc/apps/search/local/limits.conf subsearch_maxout = 100000
/app/splunk/etc/apps/search/local/limits.conf maxout = 1000000

-bash-4.2$ cat /app/splunk/etc/apps/search/local/limits.conf
[subsearch]
maxout=1000000

[join]
subsearchmaxout = 100000
subsearch
maxtime = 120
subsearch_timeout = 240

Indexer

splunk btool limits list --debug | grep maxout

/app/splunk/etc/slave-apps/asdaallindexes/local/limits.conf subsearchmaxout = 100000
/app/splunk/etc/slave-apps/asda
all_indexes/local/limits.conf maxout = 1000000

-bash-4.2$ cat /app/splunk/etc/slave-apps/asdaallindexes/local/limits.conf
[subsearch]
maxout=1000000

[join]
subsearchmaxout = 100000
subsearch
maxtime = 120
subsearch_timeout = 240

0 Karma
Highlighted

Re: Subsearch produced 50000 results, truncating to maxout 50000

Champion

btool output looks good.. not sure of whats going on..

maybe, after running a search you can click the Job menu and select Inspect Job to open the Search Job Inspector. that might give you some hints.

0 Karma
Highlighted

Re: Subsearch produced 50000 results, truncating to maxout 50000

Motivator

HI

I am having the same issues, did you get a fix?

Thanks
Robert

Highlighted

Re: Subsearch produced 50000 results, truncating to maxout 50000

Motivator

HI

I am having the same issues, did you get a fix?

Thanks
Robert

0 Karma