Splunk Search

auto-finalized after time limit ( 30 seconds )

abhayneilam
Contributor

I am getting the following warning while running my big query :

auto-finalized after time limit ( 30 seconds ) reached

can you please let me know what to do if I get this warning, and how does it effect to my query result.and how to increase the time limit for this

0 Karma

marellasunil
Communicator

Or you can use
... |append maxtime=100 [search ... ]

0 Karma

marellasunil
Communicator

The query will finalize its search and you will receive the result till 30 secs only (Not actual result).
If you are having any sub searches, change the time limit in limits.conf (Splunk\etc\system\default\limits.conf).
Hopefully it will work...

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...