problem with lookup command

[abhayneilam]

Hi,

I am getting the following error while running a lookup command with |inputlookup :

[subsearch]: Subsearch produced 726406 results, truncating to maxout 50000.

Please let me know how to get it solved !!

Thanks,
Abhay

[kristian_kolb]

from the docs on limits.conf

[searchresults]
* This stanza controls search results for a variety of Splunk search commands.

maxresultrows = <integer>
* Configures the maximum number of events are generated by search commands which 
grow the size of your result set (such as multikv) or that create events. Other search commands are explicitly 
controlled in specific stanzas below.
* This limit should not exceed 50000. Setting this limit higher than 50000 causes instability.
* Defaults to 50000.

and also;

[subsearch]
* This stanza controls subsearch results.

maxout = <integer>
* Maximum number of results to return from a subsearch.
* This value cannot be greater than or equal to 10500.
* Defaults to 100.

So it looks like you're hitting a limit somewhere. You'd probably get better help if you provided more info on the search you're running.

/K

[abhayneilam]

Can I get some kind of help in this, plz help !! I am seriously seeking some kind of usefull help !!

Thanks,

[abhayneilam]

Thanks for your information, but what will happen if my results are more than 50,000 rows ?

Following query I am running to find the actual results :

|inputlookup "one_file.csv" | append [ |inputlookup "second_file.csv" ] | append [ |inputlookup "third_file.csv" ] | lookup "Master_file.csv" user_sso

Please let me know how to get rid of the above mentioned "Warning Message"