https://community.splunk.com/t5/Splunk-Search/Impact-of-Increasing-the-limit-of-stats-list-from-100-to-say-1/m-p/486017#M135975 <P>I am using stats list() for a use case. But the data I am dealing is lot more, than the limit that is set to =100 in limit.conf for stats list() function. I thought about using Stats Values(), but as it breaks the event order, I am stuck with stats list().</P> <P>I am thinking of increasing the limit of stats list() from 100 to say 1,00,000 for example. </P> <P>What I am concerned about is, will there be any performance issue if I increase the stats list() or will there be any problem if I increase it? Just to be on the safe side.</P> <P>Any help would be appreciated.</P> Wed, 22 Jan 2020 06:07:55 GMT ahmadshakir1952 2020-01-22T06:07:55Z https://community.splunk.com/t5/Splunk-Search/Impact-of-Increasing-the-limit-of-stats-list-from-100-to-say-1/m-p/486017#M135975 <P>I am using stats list() for a use case. But the data I am dealing is lot more, than the limit that is set to =100 in limit.conf for stats list() function. I thought about using Stats Values(), but as it breaks the event order, I am stuck with stats list().</P> <P>I am thinking of increasing the limit of stats list() from 100 to say 1,00,000 for example. </P> <P>What I am concerned about is, will there be any performance issue if I increase the stats list() or will there be any problem if I increase it? Just to be on the safe side.</P> <P>Any help would be appreciated.</P> Wed, 22 Jan 2020 06:07:55 GMT https://community.splunk.com/t5/Splunk-Search/Impact-of-Increasing-the-limit-of-stats-list-from-100-to-say-1/m-p/486017#M135975 ahmadshakir1952 2020-01-22T06:07:55Z https://community.splunk.com/t5/Splunk-Search/Impact-of-Increasing-the-limit-of-stats-list-from-100-to-say-1/m-p/486018#M135976 <PRE><CODE>| makeresults count=100000 | streamstats count | stats list(count) as list_100000 </CODE></PRE> <P>Hi, @ahmadshakir1952 <BR /> As I run this query, It is certainly omitted.</P> <P>I don't know your query. What's your query?<BR /> There may be alternatives.</P> Wed, 22 Jan 2020 11:20:19 GMT https://community.splunk.com/t5/Splunk-Search/Impact-of-Increasing-the-limit-of-stats-list-from-100-to-say-1/m-p/486018#M135976 to4kawa 2020-01-22T11:20:19Z https://community.splunk.com/t5/Splunk-Search/Impact-of-Increasing-the-limit-of-stats-list-from-100-to-say-1/m-p/486019#M135977 <P>On your question about the performance impact, you might end up running into OOM issues and your search performance might also get degraded, as suggested by @to4kawa there might be alternatives available, if you can post your query and some mockup data and the desired output we can try to help you out</P> Wed, 22 Jan 2020 14:22:01 GMT https://community.splunk.com/t5/Splunk-Search/Impact-of-Increasing-the-limit-of-stats-list-from-100-to-say-1/m-p/486019#M135977 soumyasaha25 2020-01-22T14:22:01Z