Dear Sir
When I run a long search.
The Splunk always reponsd this message.
[subsearch]: Search auto-finalized after time limit reached (30 seconds). Results may be incomplete.
and then ... subsearch's result can't be finished.
How to modify this time limit ???
I have add limits.conf to my apps's local directory
Below is my limits.conf's settings --
[subsearch]
maxtime = 180
timeout = 180
and then .... restart splunk service
and then .... it isn't workable
Do you have other method to fix this issue ?
Below is my search ...
index="wms_summary" search_name="Summary Basic Data Output 01" $Param_API_Name$
| `GenerateTimeFields`
| dedup Week_Number, Request_API_Name, Sub_ID
| stats min(Event_Time) as Event_Start_Time, max(Event_Time) as Event_End_Time, count(Sub_ID) as Sub_ID_Number by Week_Number, Request_API_Name
| fields + Event_Start_Time, Event_End_Time, Request_API_Name, Sub_ID_Number
| `FieldsRename`
| append
[search index="wms_summary" search_name="Summary Basic Data Output 01" $Param_API_Name$
| stats min(_time) as Convert_Start_Time, max(_time) as Convert_End_Time, values(Request_API_Name) as Request_API_Name, dc(Sub_ID) as Sub_ID_Number
| convert mktime(Convert_Start_Time) as Unix_Start_Time
| convert timeformat="%Y/%m/%d" ctime(Unix_Start_Time) as Event_Start_Time
| convert mktime(Convert_End_Time) as Unix_End_Time
| convert timeformat="%Y/%m/%d" ctime(Unix_End_Time) as Event_End_Time
| eval $Param_API_Name$
| eval Request_API_Name = if(Request_API_Name == "*", "ALL_Sites", Request_API_Name)
| fields + Event_Start_Time, Event_End_Time, Request_API_Name, Sub_ID_Number
| `FieldsRename`]
