But how large can the salt be?
It is unsigned int (source, look for ScanHash_CryptoPP and nNonce variable there).
The range of the salt (nonsense) is: 0 to 2^32.
Couldn't I just [...] to get a new salt [...] to find a suitable output [...]?
No, you couldn't. The problem is that a cryptographic hash function, such as SHA256, must have statistically significant uniform distribution. Such distribution results in an avalanche effect. In simple words, if you change just a single bit in the input, each of the output bits will change with a 50% chance.
It means that you mathematically cannot tweak an input, to get a desired output. You cannot predict which salt will result in the correct output. Your only choice is to try-check. Have a look at the "manual mining" demoed in this answer.
This is good information, but if the nonce can only range from 1 to 4 billion and an ASIC bitcoin miner can calculate 2 billion hashes per second, isn't it going to run out of nonce real quick? – Roger Perkins – 2014-01-09T06:20:48.177
Okay, this helps: http://bitcoin.stackexchange.com/questions/13952/why-do-we-need-a-mining-speed-above-4-3ghash-s?rq=1
– Roger Perkins – 2014-01-09T06:25:42.723@RogerPerkins If you run out of nonces, which start at
0, you can increment the timestamp. – None – 2014-01-09T14:05:52.817