Splunk Search

Does multisearch suffer from subsearch limits?

marcusnilssonmr
Path Finder
 
Tags (1)

acharlieh
Influencer

That is a very good question! So let's figure it out. First create a test index in your splunk instance. Next we can use gentimes to create 259,200 events (number of seconds in 3 days) and use a summary indexing command collect to populate that index like so:

| gentimes increment=1s start=-3 end=0 | eval _raw=strftime(starttime,"%FT%TZ").", one=1" | fields + _raw | collect index=test

Now we can use multisearch to test our theory. If we are subject to the subsearch maxout limit of 10,000 results, then the following search should only pull back 30,000 events:

| multisearch [search index=test earliest=-7d@d] [search index=test earliest=-7d@d] [search index=test earliest=-7d@d]

And we pull back 777,600 events. Thus multisearch must not be subject to the standard subsearch limit.

cleavesn
Engager

Thank you for the note!

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...