https://community.splunk.com/t5/Splunk-Search/Search-returning-only-1000-rows/m-p/68570#M17208 <P>Yes. I have verified that all of the events have been indexed by using the following commaand "source="/data/inbound/Alaska.CSV" | stats sum(count)"...... this command states that there 1337 matching events</P> Wed, 19 Dec 2012 18:01:19 GMT ugillr 2012-12-19T18:01:19Z https://community.splunk.com/t5/Splunk-Search/Search-returning-only-1000-rows/m-p/68566#M17204 <P>I am sending CSV files to my Splunk machine. These files vary in record count from 1 to 5000. When I search for all of the rows from a particular source with a string like this "source="/data/inbound/Alaska.CSV" it only returns the first 1000 rows when actually there are 1337 rows. This behaviour occurs for each file which has more than 1000 rows. I know this is some sort of config setting. I just can't find the correct one. I have changed maxresultrows to be a value of 10000 but that doesn't seem to make any difference.</P> Wed, 19 Dec 2012 13:43:51 GMT https://community.splunk.com/t5/Splunk-Search/Search-returning-only-1000-rows/m-p/68566#M17204 ugillr 2012-12-19T13:43:51Z https://community.splunk.com/t5/Splunk-Search/Search-returning-only-1000-rows/m-p/68567#M17205 <P>Is every CSV file one event or is every row in a CSV file one event?</P> Wed, 19 Dec 2012 14:26:15 GMT https://community.splunk.com/t5/Splunk-Search/Search-returning-only-1000-rows/m-p/68567#M17205 martin_mueller 2012-12-19T14:26:15Z https://community.splunk.com/t5/Splunk-Search/Search-returning-only-1000-rows/m-p/68568#M17206 <P>Every row is an event</P> Wed, 19 Dec 2012 14:30:16 GMT https://community.splunk.com/t5/Splunk-Search/Search-returning-only-1000-rows/m-p/68568#M17206 ugillr 2012-12-19T14:30:16Z https://community.splunk.com/t5/Splunk-Search/Search-returning-only-1000-rows/m-p/68569#M17207 <P>Have you verified that the correct number of events has been indexed, for example by checking the summary page for some sources?</P> <P>I'm asking these things because a limitation of 1000 events for a plain old search sounds very odd and un-Splunk-ish.</P> Wed, 19 Dec 2012 14:53:05 GMT https://community.splunk.com/t5/Splunk-Search/Search-returning-only-1000-rows/m-p/68569#M17207 martin_mueller 2012-12-19T14:53:05Z https://community.splunk.com/t5/Splunk-Search/Search-returning-only-1000-rows/m-p/68570#M17208 <P>Yes. I have verified that all of the events have been indexed by using the following commaand "source="/data/inbound/Alaska.CSV" | stats sum(count)"...... this command states that there 1337 matching events</P> Wed, 19 Dec 2012 18:01:19 GMT https://community.splunk.com/t5/Splunk-Search/Search-returning-only-1000-rows/m-p/68570#M17208 ugillr 2012-12-19T18:01:19Z https://community.splunk.com/t5/Splunk-Search/Search-returning-only-1000-rows/m-p/68571#M17209 <P>"... | stats count" would produce a nicer-looking result <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>Leaving off the "| stats..." only gives you 1000 matching results? That makes no sense.</P> <P>A quick grep through my local configuration doesn't cough up any setting that limits anything related to the number of events a search can yield to 1000, so I'm stumped.</P> Thu, 20 Dec 2012 08:06:35 GMT https://community.splunk.com/t5/Splunk-Search/Search-returning-only-1000-rows/m-p/68571#M17209 martin_mueller 2012-12-20T08:06:35Z https://community.splunk.com/t5/Splunk-Search/Search-returning-only-1000-rows/m-p/68572#M17210 <P>Is this through Splunkweb?</P> Thu, 20 Dec 2012 09:07:44 GMT https://community.splunk.com/t5/Splunk-Search/Search-returning-only-1000-rows/m-p/68572#M17210 Ayn 2012-12-20T09:07:44Z https://community.splunk.com/t5/Splunk-Search/Search-returning-only-1000-rows/m-p/68573#M17211 <P>Yes. This is occurring through Splunkweb.</P> Thu, 20 Dec 2012 13:08:48 GMT https://community.splunk.com/t5/Splunk-Search/Search-returning-only-1000-rows/m-p/68573#M17211 ugillr 2012-12-20T13:08:48Z https://community.splunk.com/t5/Splunk-Search/Search-returning-only-1000-rows/m-p/68574#M17212 <P>Could you let us know what is the version of your Splunk instance?</P> Wed, 26 Dec 2012 16:46:44 GMT https://community.splunk.com/t5/Splunk-Search/Search-returning-only-1000-rows/m-p/68574#M17212 wagnerbianchi 2012-12-26T16:46:44Z https://community.splunk.com/t5/Splunk-Search/Search-returning-only-1000-rows/m-p/68575#M17213 <P>I am using the 5.0 version</P> Wed, 02 Jan 2013 13:08:09 GMT https://community.splunk.com/t5/Splunk-Search/Search-returning-only-1000-rows/m-p/68575#M17213 ugillr 2013-01-02T13:08:09Z https://community.splunk.com/t5/Splunk-Search/Search-returning-only-1000-rows/m-p/68576#M17214 <P>Since you've accepted an answer, was your problem solved? Would you mind sharing what the problem was and how you resolved it?</P> Fri, 04 Jan 2013 10:07:06 GMT https://community.splunk.com/t5/Splunk-Search/Search-returning-only-1000-rows/m-p/68576#M17214 Ayn 2013-01-04T10:07:06Z https://community.splunk.com/t5/Splunk-Search/Search-returning-only-1000-rows/m-p/68577#M17215 <P>We had the same issue and Splunk Support provided us the solution which worked for us. We are using Splunk 5.0.</P> <P>In limits.conf, change the following line. Default is 1000.</P> <P>max_events_per_bucket = 1000</P> Mon, 28 Sep 2020 13:03:07 GMT https://community.splunk.com/t5/Splunk-Search/Search-returning-only-1000-rows/m-p/68577#M17215 xchang1226 2020-09-28T13:03:07Z https://community.splunk.com/t5/Splunk-Search/Search-returning-only-1000-rows/m-p/68578#M17216 <P>Made the change described above then recycled Splunk and it now works like a champ. Thanx!</P> Fri, 04 Jan 2013 19:13:12 GMT https://community.splunk.com/t5/Splunk-Search/Search-returning-only-1000-rows/m-p/68578#M17216 ugillr 2013-01-04T19:13:12Z