Splunk Search

limits.conf modify time out search

splunkcol
Builder

 

I am performing a query to generate a chart.

The query time range is the previous 7 days, when I use this time range I get the error message that I attach, but when I lower the time to 5 or 4 days if I get the information.

By discard it is because of the time it is taking, I don't know if I'm wrong but there is some configuration that limits a maximum time in seconds until it generates a take out or cancels it splunk.

Someone suggested that I review the limits.conf file, but when I review the documentation, I don't see which stanza I should modify.

I appreciate if someone can guide me

splunkcol_0-1613750317894.png

https://docs.splunk.com/Documentation/Splunk/8.1.2/Admin/Limitsconf#.5Bsearch.5D

Labels (3)
0 Karma
1 Solution

tscroggins
Influencer

@splunkcol 

If your search is auto-finalizing before it completes, you'll need to adjust srchMaxTime for your role in authorize.conf. Also review srchTimeWin (maximum time range), srchDiskQuota, and other role-based limits, depending on the errors/messages shown.

View solution in original post

tscroggins
Influencer

@splunkcol 

If your search is auto-finalizing before it completes, you'll need to adjust srchMaxTime for your role in authorize.conf. Also review srchTimeWin (maximum time range), srchDiskQuota, and other role-based limits, depending on the errors/messages shown.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...