I am getting the following warning while running my big query :
auto-finalized after time limit ( 30 seconds ) reached
can you please let me know what to do if I get this warning, and how does it effect to my query result.and how to increase the time limit for this
Or you can use
... |append maxtime=100 [search ... ]
The query will finalize its search and you will receive the result till 30 secs only (Not actual result).
If you are having any sub searches, change the time limit in limits.conf (Splunk\etc\system\default\limits.conf).
Hopefully it will work...