Why are we getting "[subsearch]: Search auto-finalized after time limit (60 seconds) reached" error?

[ddrillic]

We get the error such as -

[subsearch]: Search auto-finalized after time limit(60 seconds) reached.

We changed the following for the search app while we use a different app -

$ cat limits.conf
[search]
# setting for an hour
maxtime = 216000

Any ideas?

[ddrillic · Accepted solution]

We ended up having the following in limits.conf -

[subsearch]
maxout = 50000
maxtime = 3600
ttl = 300

[join]
subsearch_maxout = 50000
subsearch_maxtime = 3600
subsearch_timeout = 360

It works!!! ; - )

[woodcock]

You could run a scheduled search to pull the hunk data in on a regular basis and then use loadjob in your subsearch to access the hunk data from the scheduled search (or ref if in a dashboard panel).

[ddrillic]

Interesting - we should try that...

[woodcock]

You should show your subsearch; there must be something wrong with it taking so long. It needs optimization.

[ddrillic]

It's a Hunk one - huge data set ; -)

[woodcock]

One of the very few GOOD reasons to resort to upping the timeout.

[ddrillic]

Very kind @woodcock ; -)

But, you see, why does the error message speak about 60 seconds after we upped the timeout interval to an hour?

[DalJeanis]

did you restart splunk after changing the configuration?

[ddrillic]

Oh yeah - we did.