Troubleshoot missing applications

The number of applications assigned to agent or agents assigned to application displayed on the interface is less than expected or 0, or saved search results show error messages related to truncation or time limit.

  • Applications interface shows 0 agents or shows less agents than expected for some applications.

  • Agents interface shows 0 assigned applications or shows less applications than expected for some agents.

  • When you check the saved search results, error messages related to result truncation are displayed.

  • When you check the saved search results, a message related to the time limit is displayed.

The default limits of the following settings are too low, causing results to be truncated:

  • *[join] `subsearch_maxout` - default 50000

  • *[stats] `list_maxsize` - default 100

  • *[join] `subsearch_maxtime` - default 60

  1. Open the limits.conf file that is located in $SPLUNK_HOME/etc/system/local/limits.conf.
  2. If you have more than 50000 agents, adjust the subsearch_maxout setting under the [join] stanza:
    CODE 
    subsearch_maxout = 75000
*Default = 50000
    Set a value that accommodates your expected maximum number of agents.
  3. If you have more than 100 applications assigned to a single agent, adjust the list_maxsize setting under the [stats] stanza:
    CODE 
    list_maxsize = 200
*Default = 100

    Set a value that accommodates your expected maximum number of applications assigned to a single agent.

  4. If changing settings in steps 2 or 3 doesn't match your setup or it didn't resolve the issue and saved search result displays the message about the time limit, adjust the subsearch_maxtime setting under the [join] stanza:
    CODE 
    subsearch_maxtime = 300
*Default = 60

    Set a value that accommodates your expected runtime of the DeploymentServerCreateAgentsLookup saved search job.

  5. Save your changes.