When utilizing a subsearch within a Splunk SPL search query, which of the following statements is accurate?
A) Subsearches have to be initiated with the | subsearch command. Subsearches have to be initiated with the | subsearch command.
B) Subsearches can only be utilized with | inputlookup command. Subsearches can only be utilized with | inputlookup
C) Subsearches have a default result output limit of 10000.
D) There are no specific limitations when using subsearches.

Question

Quizplus · Accepted Answer

Subsearches in Splunk have a default result output limit of 10,000 results.

When Utilizing a Subsearch Within a Splunk SPL Search Query