https://community.splunk.com/t5/Splunk-Search/In-sort-command-I-want-to-avoid-limit-of-10-000-rows-without/m-p/369354#M108823 <P>Even I didn't see any parameter in limits.conf which I can use to remove this limit with sort command. </P> Wed, 28 Jun 2017 03:59:57 GMT abhinav_maxonic 2017-06-28T03:59:57Z https://community.splunk.com/t5/Splunk-Search/In-sort-command-I-want-to-avoid-limit-of-10-000-rows-without/m-p/369351#M108820 <P>When I sort my data by some field, by default its has limit of 10,000 rows. If I use attribute count=0 along with sort command it removes this limit. I want to know if I can do any settings or change any parameter in any conf file, so that next time I don't have to use "count=0" in order to avoid the limit of 10,000 rows. </P> Fri, 23 Jun 2017 05:39:06 GMT https://community.splunk.com/t5/Splunk-Search/In-sort-command-I-want-to-avoid-limit-of-10-000-rows-without/m-p/369351#M108820 abhinav_maxonic 2017-06-23T05:39:06Z https://community.splunk.com/t5/Splunk-Search/In-sort-command-I-want-to-avoid-limit-of-10-000-rows-without/m-p/369352#M108821 <P>well, there is a limits.conf file, but its not having any options for sort command. </P> <P>one more thing - you were saying "sort count=0"<BR /><BR /> actually, we need not include "count=".. just add a "0" after sort. </P> <P>so, to get all results we have to run <BR /> - for example to sort by host<BR /> <CODE>&lt;source&gt; | sort 0 host</CODE> </P> Fri, 23 Jun 2017 06:37:03 GMT https://community.splunk.com/t5/Splunk-Search/In-sort-command-I-want-to-avoid-limit-of-10-000-rows-without/m-p/369352#M108821 inventsekar 2017-06-23T06:37:03Z https://community.splunk.com/t5/Splunk-Search/In-sort-command-I-want-to-avoid-limit-of-10-000-rows-without/m-p/369353#M108822 <P>It is a common best practice to ALWAYS use <CODE>sort 0</CODE> instead of <CODE>sort</CODE> because of this silly default trimming value.<BR /> I am unaware of any way to change this default.</P> Fri, 23 Jun 2017 08:38:01 GMT https://community.splunk.com/t5/Splunk-Search/In-sort-command-I-want-to-avoid-limit-of-10-000-rows-without/m-p/369353#M108822 woodcock 2017-06-23T08:38:01Z https://community.splunk.com/t5/Splunk-Search/In-sort-command-I-want-to-avoid-limit-of-10-000-rows-without/m-p/369354#M108823 <P>Even I didn't see any parameter in limits.conf which I can use to remove this limit with sort command. </P> Wed, 28 Jun 2017 03:59:57 GMT https://community.splunk.com/t5/Splunk-Search/In-sort-command-I-want-to-avoid-limit-of-10-000-rows-without/m-p/369354#M108823 abhinav_maxonic 2017-06-28T03:59:57Z https://community.splunk.com/t5/Splunk-Search/In-sort-command-I-want-to-avoid-limit-of-10-000-rows-without/m-p/369355#M108824 <P>Np. Thanks for answering. </P> Wed, 28 Jun 2017 04:00:20 GMT https://community.splunk.com/t5/Splunk-Search/In-sort-command-I-want-to-avoid-limit-of-10-000-rows-without/m-p/369355#M108824 abhinav_maxonic 2017-06-28T04:00:20Z https://community.splunk.com/t5/Splunk-Search/In-sort-command-I-want-to-avoid-limit-of-10-000-rows-without/m-p/369356#M108825 <P>from splunk's developer point of view, this does not require a config file editing, processing the config file, etc.,.. after "sort", all you need to add is just "a space, 0, another space" ("<EM>0</EM>"). </P> <P>i think the developers usually do this as a general a way of making the users to learn the commands and tools (the linux commands and tools, for example vi, sed .. all full of these small twists and turns <span class="lia-unicode-emoji" title=":winking_face:">😉</span> )</P> Wed, 28 Jun 2017 04:29:22 GMT https://community.splunk.com/t5/Splunk-Search/In-sort-command-I-want-to-avoid-limit-of-10-000-rows-without/m-p/369356#M108825 inventsekar 2017-06-28T04:29:22Z