What is the maximum run time allowed for a subsearch?

The maximum run time allowed for a subsearch in Splunk is indeed 60 seconds. Subsearches are designed to be efficient and are typically used to run a search within the context of another search. This 60-second limit ensures that the primary search does not have to wait too long for results from the subsearch, allowing for more responsive performance.

In practice, if a subsearch exceeds this time limit, Splunk will terminate it to maintain overall search performance. This design choice helps optimize resource usage and keeps queries performant, ensuring that users can still obtain timely results from their searches. Understanding this limitation is crucial for effectively structuring your searches, particularly when using subsearches to filter or gather data for larger datasets.