Hello,
I would to run a scheduled report once. A very log time search, I don't care about performance or time to complete.
I set in local **limits.conf**
[subsearch]
# maximum number of results to return from a subsearch
maxout = 100000
but the *job inspector* says:
INFO: [subsearch]: Subsearch produced 255526 results, truncating to maxout
50000.
Why does it say 50000 and not the 100000 configured value?
I would like to know how to increase the *maxout* up to 300000.
I don't use the *append* command, so I can't set maxout on the search itself.
Just for info, my search is
host=*myhost [search host=thishost KLMS av_status=Clean as_status=Clean | table message_id] | transaction message_id ...
I have to run it for a 30 day interval.
Thank you very much
Best Regards
Marco
↧