topic Re: loadjob limits 1000lines in Reporting

loadjob limits 1000lines

crazyeva — Tue, 30 Jul 2013 17:10:13 GMT

hello
i am trying to load events from a saved search which contains 10000+ events
|load pid events=t
but this only return 1000 rows
how could i break the limitation?
thanks

Re: loadjob limits 1000lines

cdstealer — Wed, 16 Oct 2013 13:32:04 GMT

Hi Eva,
I'm having the same issue. Did you get this resolved?

Steve

Re: loadjob limits 1000lines

obhatti — Tue, 10 Feb 2015 21:23:49 GMT

Hi,

Was this question answered? I am looking at a similar problem.

Thanks

Re: loadjob limits 1000lines

nickbloglovin — Fri, 09 Sep 2016 20:31:37 GMT

has anyone figured this out since 2013?

Re: loadjob limits 1000lines

tfletcher_splun — Tue, 13 Sep 2016 00:52:05 GMT

If you append a table command with the field list you are interested in it may work around your issue.

Re: loadjob limits 1000lines

crazyeva — Wed, 14 Sep 2016 01:38:27 GMT

To verify your suggestion, I tried this but can not repeat my issue again.

|loadjob SID events=t

It returned more than 1000 events. Splunk version 6.4
I forgot why I used "load" and "pid", and what I searched 3 years ago.
Any one have the same issue, could you plz post your search conditions?

Re: loadjob limits 1000lines

DalJeanis — Fri, 17 Feb 2017 19:15:28 GMT

|loadjob SID events=t

Re: loadjob limits 1000lines

tfletcher_splun — Fri, 17 Feb 2017 19:23:25 GMT

The issue was likely fixed in a more recent version of splunk. The table command was just a workaround because it transforms event data into results data and thus worked around the bug in loading all of the events data.

Re: loadjob limits 1000lines

kranzrm — Mon, 24 Jul 2017 19:40:35 GMT

Same problem, even with DalJeanis's suggestion... Any fix?

Re: loadjob limits 1000lines

mrgibbon — Tue, 15 Aug 2017 03:58:43 GMT

Same issue here.... 18,000 events, only 1,000 returned using loadjob.