Splunk Search

[subsearch]: Subsearch produced 12959 results, truncating to maxout 10000.

hylee
Explorer

When I put below,

sourcetype="splunk_page_request" NOT [| inputlookup nmc_crawlers | fields ip_address]

I got a message below,

[subsearch]: Subsearch produced 12959 results, truncating to maxout 10000.

How can I solve this?

1 Solution

linu1988
Champion

By default the subsearch result set limit is set to 10000. You can increase it in the limits.conf file. But it's not recommended to go beyond 10500. I have not tried to modify it to greater value but if its not working then need to think of something else. May be you can use Join which has a greater sub search value.

maxout =
* Maximum number of results to return from a subsearch.
* This value cannot be greater than or equal to 10500.
* Defaults to 10000.

Please refer:
http://docs.splunk.com/Documentation/Splunk/5.0.3/Admin/Limitsconf

View solution in original post

krugger
Communicator

The solution in the comments is valid, but you can also try:

sourcetype="splunk_page_request" NOT [| inputlookup nmc_crawlers | dedup ip_address |fields ip_address]

This will try to deduplicate the entries with the same IP in the nmc_crawlers lookup, hence reducing the number of returned address.

linu1988
Champion

By default the subsearch result set limit is set to 10000. You can increase it in the limits.conf file. But it's not recommended to go beyond 10500. I have not tried to modify it to greater value but if its not working then need to think of something else. May be you can use Join which has a greater sub search value.

maxout =
* Maximum number of results to return from a subsearch.
* This value cannot be greater than or equal to 10500.
* Defaults to 10000.

Please refer:
http://docs.splunk.com/Documentation/Splunk/5.0.3/Admin/Limitsconf

hylee
Explorer

Thank you so much!! I changed maxout to 13000 and it worked.

0 Karma
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf24, and Community Connections

Thank you to everyone in the Splunk Community who joined us for .conf24 – starting with Splunk University and ...

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...