Splunk Search

What would be a few reasons to limit the subsearch maxout setting in the join stanza instead of letting the memory constraint be the limiting factor?

mschellhouse
Path Finder

We are discussing the subsearch_max configuration setting in limits.conf internally and trying to better understand the benefit to setting a limit? It seems as though the better constraint is search memory mgt as I can use various tuning options ("fields" command immediately comes to mind) to limit the size of subsearch but be over some arbitrary numeric threshold.

valiquet
Contributor

To be able to predict and to now when you will reach or reached the limit.

0 Karma
Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of Splunk APM’s and Splunk RUM’s streaming infrastructure in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...