https://community.splunk.com/t5/Splunk-Enterprise/Is-the-only-to-change-the-subsearch-limit-is-to-modify-limits/m-p/616301#M14131 <P>sort 0 only affects the number of events in the sort, not the subsearch (which is still restricted to 50000)</P><P>You can however do multiple appends, each with a different subset of events!</P> Fri, 07 Oct 2022 10:23:58 GMT ITWhisperer 2022-10-07T10:23:58Z https://community.splunk.com/t5/Splunk-Enterprise/Is-the-only-to-change-the-subsearch-limit-is-to-modify-limits/m-p/616292#M14128 <P><SPAN>Hi</SPAN></P> <P><SPAN>I have a basic question about the append limit which is 50000 events max</SPAN></P> <P><SPAN>Does it means that only the 50000 first events sorted by timestamp are displayed (from newest to oldest)?</SPAN></P> <P><SPAN>And in some discussions, it seems that these limit could be overrided with</SPAN></P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <LI-CODE lang="markup"> | sort 0 </LI-CODE> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> <P><SPAN><A href="https://community.splunk.com/t5/Splunk-Search/Using-sort-0-to-avoid-10000-row-limit/m-p/502707" target="_blank" rel="noopener">https://community.splunk.com/t5/Splunk-Search/Using-sort-0-to-avoid-10000-row-limit/m-p/502707</A></SPAN></P> <P><SPAN>is it true or the only way to change the limit is to modify&nbsp;limits.conf?</SPAN></P> <P><SPAN>thanks</SPAN></P> <P>&nbsp;</P> Tue, 11 Oct 2022 13:14:48 GMT https://community.splunk.com/t5/Splunk-Enterprise/Is-the-only-to-change-the-subsearch-limit-is-to-modify-limits/m-p/616292#M14128 jip31 2022-10-11T13:14:48Z https://community.splunk.com/t5/Splunk-Enterprise/Is-the-only-to-change-the-subsearch-limit-is-to-modify-limits/m-p/616301#M14131 <P>sort 0 only affects the number of events in the sort, not the subsearch (which is still restricted to 50000)</P><P>You can however do multiple appends, each with a different subset of events!</P> Fri, 07 Oct 2022 10:23:58 GMT https://community.splunk.com/t5/Splunk-Enterprise/Is-the-only-to-change-the-subsearch-limit-is-to-modify-limits/m-p/616301#M14131 ITWhisperer 2022-10-07T10:23:58Z https://community.splunk.com/t5/Splunk-Enterprise/Is-the-only-to-change-the-subsearch-limit-is-to-modify-limits/m-p/616643#M14173 <P>doest it means there is a sort events number imit if we dont use | sort 0?</P> Tue, 11 Oct 2022 10:01:46 GMT https://community.splunk.com/t5/Splunk-Enterprise/Is-the-only-to-change-the-subsearch-limit-is-to-modify-limits/m-p/616643#M14173 jip31 2022-10-11T10:01:46Z https://community.splunk.com/t5/Splunk-Enterprise/Is-the-only-to-change-the-subsearch-limit-is-to-modify-limits/m-p/616685#M14185 <P><A href="https://docs.splunk.com/Documentation/Splunk/9.0.1/SearchReference/Sort" target="_blank">sort - Splunk Documentation</A></P> Tue, 11 Oct 2022 14:04:15 GMT https://community.splunk.com/t5/Splunk-Enterprise/Is-the-only-to-change-the-subsearch-limit-is-to-modify-limits/m-p/616685#M14185 ITWhisperer 2022-10-11T14:04:15Z