Thanks to a previous post you need to change two stanzas in the limits.conf. [join] & [searchresults]. So for example I now have in $SPLUNK_HOME/etc/system/local/limits.conf: [join] subsearch_maxout = 500000 [searchresults] maxresultrows = 500000 Note the above value is 500,000. I have added an extra 0 to the defaul I believe this is because when you run the "join" in your query you are also using the "search" command so both parts are limiting you to the default of 50,000. i.e. joint FIELDNAME [search index=..... ... View more

I have the same issue. A join query returns only 50000 out of the 87000 that I expect. So using the answer above I set system/local/limits.conf and increased the maxout to 5M. Restarted splunk and still having the same issue. Output of "splunk cmd btool limits list join" gives: [join] subsearch_maxout = 500000 subsearch_maxtime = 60 subsearch_timeout = 120 Any other ideas? Or is this a bug? (FYI. I am using Splunk Enterprise v6.3.0) ... View more

I have just configured this on DB Connect v1.2.2 using a thin connection string with an address list containing two hosts and it works for me. First I had to create a new database type in $SPLUNK_HOME/etc/apps/dbx/local/database_types.conf and hard code the hostnames of the multiple hosts. The only dynamic parts in the connection string are the service name (SID) and port: #Bits in bold can/need to be changed to reflect your environment [oracle-service-x] displayName = OracleServiceX defaultCatalogName = ORCLX jdbcDriverClass = oracle.jdbc.OracleDriver connectionUrlFormat = jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS_LIST=(LOAD_BALANCE=off)(ADDRESS=(PROTOCOL=TCP)(HOST=host1)(PORT={1}))(ADDRESS=(PROTOCOL=TCP)(HOST=host2)(PORT={1})))(CONNECT_DATA=(SERVER=DEDICATED)(SERVICE_NAME={2}))) testQuery = SELECT 1 FROM DUAL defaultPort = 1521 Then I added a new connection by editing the configuration file $SPLUNK_HOME/etc/apps/dbx/local/database.conf: [ConnectionXYZ] database = SIDNAME database.sid = true host = ANYTHING isolation_level = DATABASE_SETTING password = ANYTHING port = 1521 readonly = 1 type = oracle-service-x username = ORACLEUSERNAME Then restart splunk. Using the web interface login, navigate to the newly created connection and set the password. Then all should be working. The trick to this that kept catching me out was the default configuration in $SPLUNK_HOME/etc/apps/dbx/local/database_types.conf for oracle had the line typeClass = com.splunk.dbx.sql.type.impl.Oracle and if this line exists the connectionUrlFormat line is ignored. So by simply removing this typeClass configuration the connection string is used and presumably you can use any normal oracle connection parameters. I hope this helps anyone trying to set this up. ... View more