Splunk Search

What would be a few reasons to limit the subsearch maxout setting in the join stanza instead of letting the memory constraint be the limiting factor?

Path Finder

We are discussing the subsearch_max configuration setting in limits.conf internally and trying to better understand the benefit to setting a limit? It seems as though the better constraint is search memory mgt as I can use various tuning options ("fields" command immediately comes to mind) to limit the size of subsearch but be over some arbitrary numeric threshold.

Contributor

To be able to predict and to now when you will reach or reached the limit.

0 Karma