https://community.splunk.com/t5/Splunk-Search/Using-sort-0-to-avoid-10000-row-limit/m-p/502707#M139897 <P><IMG src="http://clipartmag.com/images/question-mark-animated-gif-31.gif" alt="alt text" /></P> <P>Sorry for the silly attention-grabbing dancing question mark. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>Thanks for any help on this. I've had to dive into the deep end of Splunk with no previous exposure for various staffing reasons, so please forgive my ignorance.</P> <H2>I'm trying to get my use of the sort 0 command (to override the 10k scheduler output limitation. I'm using the cloud version so no control on the conf files on the server or anything like that.</H2> <H3>Where am I still missing a sort 0?!?</H3> <HR /> <P>I've got this, but it's still truncating all rows after 10,000 rows.</P> <PRE><CODE>Thing.process.valid.request OR herschel.update.job.completed | transaction activity_id startswith="Thing.process.valid.request" endswith="herschel.update.job.completed" | eval start_time=_time | eval end_time=_time+duration | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(start_time) AS ThingPackager_Start | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(end_time) AS Sent_To_Thing | eval delay_hours = round(duration/60/60, 2) | rename activity_id AS tar_name | eval media_assetID=substr(tar_name,1,12) | sort 0 end_time | stats first as *, first(_*) as _* by media_assetID | table Thing_Start Sent_To_Thing start_time end_time Thing_id tar_name media_assetID delay_hours | sort 0 by delay_hours desc </CODE></PRE> <P>Thank you for any help, I'm going bonkers trying to get my head around this syntax.</P> Tue, 19 May 2020 07:47:19 GMT leica0000 2020-05-19T07:47:19Z https://community.splunk.com/t5/Splunk-Search/Using-sort-0-to-avoid-10000-row-limit/m-p/502707#M139897 <P><IMG src="http://clipartmag.com/images/question-mark-animated-gif-31.gif" alt="alt text" /></P> <P>Sorry for the silly attention-grabbing dancing question mark. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>Thanks for any help on this. I've had to dive into the deep end of Splunk with no previous exposure for various staffing reasons, so please forgive my ignorance.</P> <H2>I'm trying to get my use of the sort 0 command (to override the 10k scheduler output limitation. I'm using the cloud version so no control on the conf files on the server or anything like that.</H2> <H3>Where am I still missing a sort 0?!?</H3> <HR /> <P>I've got this, but it's still truncating all rows after 10,000 rows.</P> <PRE><CODE>Thing.process.valid.request OR herschel.update.job.completed | transaction activity_id startswith="Thing.process.valid.request" endswith="herschel.update.job.completed" | eval start_time=_time | eval end_time=_time+duration | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(start_time) AS ThingPackager_Start | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(end_time) AS Sent_To_Thing | eval delay_hours = round(duration/60/60, 2) | rename activity_id AS tar_name | eval media_assetID=substr(tar_name,1,12) | sort 0 end_time | stats first as *, first(_*) as _* by media_assetID | table Thing_Start Sent_To_Thing start_time end_time Thing_id tar_name media_assetID delay_hours | sort 0 by delay_hours desc </CODE></PRE> <P>Thank you for any help, I'm going bonkers trying to get my head around this syntax.</P> Tue, 19 May 2020 07:47:19 GMT https://community.splunk.com/t5/Splunk-Search/Using-sort-0-to-avoid-10000-row-limit/m-p/502707#M139897 leica0000 2020-05-19T07:47:19Z https://community.splunk.com/t5/Splunk-Search/Using-sort-0-to-avoid-10000-row-limit/m-p/502708#M139898 <P>This is not due to <CODE>sort</CODE><BR /> see reference:</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf#.5Btransactions.5D">https://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf#.5Btransactions.5D</A></P> Tue, 19 May 2020 14:31:22 GMT https://community.splunk.com/t5/Splunk-Search/Using-sort-0-to-avoid-10000-row-limit/m-p/502708#M139898 to4kawa 2020-05-19T14:31:22Z https://community.splunk.com/t5/Splunk-Search/Using-sort-0-to-avoid-10000-row-limit/m-p/502709#M139899 <P>You're hitting a limit in your <CODE>transaction</CODE> command. I'd also recommend adding <CODE>sort</CODE> AFTER your reporting command <CODE>stats</CODE></P> Tue, 19 May 2020 15:48:37 GMT https://community.splunk.com/t5/Splunk-Search/Using-sort-0-to-avoid-10000-row-limit/m-p/502709#M139899 skoelpin 2020-05-19T15:48:37Z