Implementing Splunk 7, Third Edition - Third Edition

Subsearch caveats

To prevent a subsearch from being too expensive, (or, in other words, requiring perhaps unreasonable time or resources to complete) it is limited by a time and event count:

• The default time limit for the subsearch to complete is 60 seconds. If the subsearch is still running at that point, it is finalized and only the events located up to that point are added to the outer search.
• Likewise, the default event limit for the subsearch is 10,000. After this point, any further events will be truncated. If either of these limits is reached, there is probably a better way to accomplish the task at hand.

Another consideration is that the fields returned from the subsearch must be searchable. There is a magical field called search ...