Troubleshoot missing agent data

Agent data displayed on the interface is incomplete, or saved search results show error messages related to truncation or time limit.

You observe one of the following symptoms:

  • Agent data displayed on the interface is incomplete, missing details like hostname or agent name.
  • When you check the saved search results, the error messages related to result truncation is displayed.
  • When you check the saved search results, a message related to time limit is displayed.
The default limits of following settings are too low, causing results to be truncated:

  • *[join] `subsearch_maxout` - default 50000

  • *[join] `subsearch_maxtime` - default 60

  1. Open the limits.conf file that is located in $SPLUNK_HOME/etc/system/local/limits.conf.
  2. If you have more than 50,000 agents, adjust the subsearch_maxout setting under the [join] stanza:
    CODE 
    subsearch_maxout = 75000
*Default = 50000
    Set a value that accommodates your expected maximum number of agents.

  3. If changing the value in step 2 doesn't match your setup or it didn't resolve the issue and saved search result displays the message about the time limit, adjust the subsearch_maxtime setting under the [join] stanza:
    CODE 
    subsearch_maxtime = 300
*Default = 60

    Set a value that accommodates your expected runtime of the DeploymentServerCreateAgentsLookup saved search job.

  4. Save your changes.