Splunk Search

limits.conf modify time out search

splunkcol
Contributor

 

I am performing a query to generate a chart.

The query time range is the previous 7 days, when I use this time range I get the error message that I attach, but when I lower the time to 5 or 4 days if I get the information.

By discard it is because of the time it is taking, I don't know if I'm wrong but there is some configuration that limits a maximum time in seconds until it generates a take out or cancels it splunk.

Someone suggested that I review the limits.conf file, but when I review the documentation, I don't see which stanza I should modify.

I appreciate if someone can guide me

splunkcol_0-1613750317894.png

https://docs.splunk.com/Documentation/Splunk/8.1.2/Admin/Limitsconf#.5Bsearch.5D

Labels (3)
0 Karma
1 Solution

tscroggins
Builder

@splunkcol 

If your search is auto-finalizing before it completes, you'll need to adjust srchMaxTime for your role in authorize.conf. Also review srchTimeWin (maximum time range), srchDiskQuota, and other role-based limits, depending on the errors/messages shown.

View solution in original post

tscroggins
Builder

@splunkcol 

If your search is auto-finalizing before it completes, you'll need to adjust srchMaxTime for your role in authorize.conf. Also review srchTimeWin (maximum time range), srchDiskQuota, and other role-based limits, depending on the errors/messages shown.

View solution in original post

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!