topic Limited rows returned Splunk CLI for a table in Splunk Search

Limited rows returned Splunk CLI for a table

EricLloyd79 — Tue, 19 Mar 2019 15:15:28 GMT

First, yes, we are using "-maxout 0"
For some reason, on one of our hosts, when we run a particular query that pipes into a table, it only returns around ~3000 rows depending on the 24 hour period we are searching for.
Here are some of the unusual things we've noticed:
(1) Its not a resource issue. We have upgraded the host to 32 GB memory and 12 cores.
(2) If we run the query and just have it return raw events, it works as expected.
(3) The query works on another host in our cluster as expected so query is good.
(4) If we run for a window that is 3 hours or LESS it will return the number of rows as expected. 4 hours or more and it returns only around 3000 rows.
(5) I did notice that around 3 hours, it returns just under 1 million rows. Im wondering if there is a 1 million rows limit for tables in the CLI.
(6) This runs as expected in the Splunk web GUI.

Any ideas?

Re: Limited rows returned Splunk CLI for a table

richgalloway — Tue, 19 Mar 2019 15:50:51 GMT

Can you share the query?

Re: Limited rows returned Splunk CLI for a table

EricLloyd79 — Tue, 29 Sep 2020 23:46:03 GMT

Sure.

/opt/splunk/bin/splunk search 'sourcetype=xyz url=/foo/bar.jsp kpi01 earliest="03/06/2019:00:00:00" latest="03/06/2019:23:59:59" | rex field=_raw "(?:[^=\n]*=){2}(?P[^ ]+)" | eval date=strftime(_time, "%Y%m%d") | table date, mdn, fullItemID | streamstats count as row | fields row *' -maxout 0 >> output15.log

Re: Limited rows returned Splunk CLI for a table

EricLloyd79 — Tue, 19 Mar 2019 16:11:56 GMT

I tried it without the regex and it produced the same ~3000 rows only.

Re: Limited rows returned Splunk CLI for a table

EricLloyd79 — Tue, 19 Mar 2019 16:30:39 GMT

As a side note, when I print results as a table, it gets to about 431207 then halts for a second and then starts over at 1 and goes to about 3000.

ex:

431200 20190306 abc 5551212
431201 20190306 abc 5551212
431202 20190306 abc 5551212
431203 20190306 abc 5551212
431204 20190306 abc 5551212
431205 20190306 abc 5551212
431206 20190306 abc 5551212
431207 20190306 abc 5551212
row date fullItemID mdn

1 20190306 abc 5551212
2 20190306 abc 5551212
3 20190306 abc 5551212
4 20190306 abc 5551212
5 20190306 abc 5551212
...