Splunk |search limited to 1000 entries

mkroczak — Wed, 19 May 2021 18:34:57 GMT

Hi there,

I'm just a basic user of Splunk in my company and I have 0 experience with programming or SQL please don't go rough on me.

I'm creating queries for extracting data for specific entries. For example:

|search LOTID = 19ADET165T0 OR 19ADET1E666 OR 19ADET1E838 OR 19ADET1FT58 OR 19ADET1G341 OR 19ADET1G511 OR 19ADET1G896 OR 19ADET1G898 OR 19ADET1G90T

Which with additional conditions will return results for these entries.

Following this method I can only create single query for maximum of 1000 entries.

Is there any way which I (basic user) can follow to get around this limitation and create succesful query for e.g. 5000 entries using |search?

Re: Splunk |search limited to 1000 entries

dhirendra761 — Wed, 19 May 2021 20:02:17 GMT

Put in the last

|head <no_of_desired_searh_results_>

for example:

<your query>| head 5000

topic Re: Splunk |search limited to 1000 entries in Splunk Search

Splunk |search limited to 1000 entries

Re: Splunk |search limited to 1000 entries