Splunk Search

Subsearch timeout SPL

mwdbhyat
Builder

Hi guys,

I have a search with subsearch that times out before it can complete. The subsearch doesnt finalise, so then then main search gets no results. Can anyone think of a better way to write this search so that perhaps that subsearch will perform better and I will not have to increase limits.conf? Are there any issues with increasing limits.conf?

index=bla [search index=bla(subject="Test*")|dedup x | table x]
|stats values(*) As * by x,filter_instance
|table _time,from,ip,recipient,subject,x

Thanks!

0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

Try this for your subsearch...

 [search index=bla (subject="Test*") x=* | stats first(index) by x | fields - index]

stats first(blah) should require less resources than dedup.

View solution in original post

0 Karma

woodcock
Esteemed Legend

Try setting a shorter static timerange that overrides the TimePicker for the subsearch like this:

 index=bla [search index=bla(subject="Test*") earliest=-1h | stats first(host) BY x | table x ]
 |stats values(*) As * by x,filter_instance
 |table _time,from,ip,recipient,subject,x
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Try this for your subsearch...

 [search index=bla (subject="Test*") x=* | stats first(index) by x | fields - index]

stats first(blah) should require less resources than dedup.

0 Karma

mwdbhyat
Builder

Thanks this worked

kmaron
Motivator

I think you may have simplified your example a little too much or maybe I'm just not following.

You're looking for the values of x that only exist when subject="Test*" but then you want to do a stats by x? I'm not seeing the purpose of the subsearch. Could you try either explaining it or maybe simplify it better?

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...