Splunk Search

What would be a few reasons to limit the subsearch maxout setting in the join stanza instead of letting the memory constraint be the limiting factor?

mschellhouse
Path Finder

We are discussing the subsearch_max configuration setting in limits.conf internally and trying to better understand the benefit to setting a limit? It seems as though the better constraint is search memory mgt as I can use various tuning options ("fields" command immediately comes to mind) to limit the size of subsearch but be over some arbitrary numeric threshold.

valiquet
Contributor

To be able to predict and to now when you will reach or reached the limit.

0 Karma
Get Updates on the Splunk Community!

Monitoring Postgres with OpenTelemetry

Behind every business-critical application, you’ll find databases. These behind-the-scenes stores power ...

Mastering Synthetic Browser Testing: Pro Tips to Keep Your Web App Running Smoothly

To start, if you're new to synthetic monitoring, I recommend exploring this synthetic monitoring overview. In ...

Splunk Edge Processor | Popular Use Cases to Get Started with Edge Processor

Splunk Edge Processor offers more efficient, flexible data transformation – helping you reduce noise, control ...