Subsearch results getting truncated while using join

[keerthana_k]

Hi,

We are currently using join for creating summary index in our application. The search runs on a daily basis for the whole day. However, the results of the sub-search keep getting truncated. We have tried increasing the limits of join in etc/system/local/limits.conf as follows:

[join]
subsearch_maxout = 10000000
subsearch_maxtime = 3600
subsearch_timeout = 3600

In spite of this change, the results still truncated. Can anyone please let me know how to fix this issue.

Thanks,

Keerthana

[Ayn]

There is a hard limit on 10500 results for subsearch output. There's no way around this. Sorry.

[keerthana_k]

I am getting the limit as 50000 and not 10500. Also I read in the documentation that join is not affected by this.

[http://docs.splunk.com/Documentation/Splunk/6.2.0/Search/Aboutsubsearches][1]