/my-app/local/limits.conf with the following content:
[subsearch] maxtime = 600 [join] subsearch_maxtime = 600 subsearch_timeout = 800
Yet when search finished - job inspector still claims that:
[subsearch]: Search auto-finalized after time limit (60 seconds) reached.
Does this means the setting is ignored, or does this mean that this message is actually incorrect?
Make sure you've restarted after making the changes, and run these two to check that Splunk understands your configuration:
./bin/splunk cmd btool --debug limits list subsearch ./bin/splunk cmd btool --debug limits list join
Side note: Use
| format to avoid having to assemble the search string manually.
If you're on 6.2.x, add this to limits.conf:
[search_info] infocsv_log_level = DEBUG
Then run your search again with the
ip-subsearch and look at the debug output at the top of the job inspector. That should present you with a complete list of IPs used for filtering.
These commands shows that Splunk honors the limits i set in limits.conf. Which means that
...time limit (60 seconds) reached. message is a bug?
Although I did experiment by comparing results of two queries - one using subsearch and another one using hardcoded search using values that subsearch suppose to return:
index=x page=hello [search index=x user=joe| dedup ip | fields ip] | stats c - this returned c=150
index=x user=joe | fields ip | dedup ip | mvcombine ip | eval ip="(ip=" + mvjoin(ip, " OR ip=") + ")" | table ip
- this returned fragment of search query:
(ip=18.104.22.168 OR ip=22.214.171.124 OR ip=...)
- So i copy/pasted this fragment and rerun main query like this:
index=x page=hello (ip=126.96.36.199 OR ip=188.8.131.52 OR ip=...) | stats c - this returned c=200
Which means query with subsearch still missed something, even with high limits value set?