topic Re: Search result limit in Splunk Search

Search result limit

corehan — Fri, 17 Sep 2021 07:53:45 GMT

Hello dears,

How can i change search result limit ? At this moment, max 10K line shown..

Re: Search result limit

hoaxm3 — Mon, 20 Sep 2021 22:15:47 GMT

10k exactly is usually due to a subsearch or the sort command. If sort, try changing sort to 'sort - 0'. If subsearch, look at the limits.conf file and increase the maxout integer.

maxout = x

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf#.5Bsubsearch.5D

Re: Search result limit

bowesmana — Mon, 20 Sep 2021 22:42:03 GMT

Why do you need to increase the lines shown? There are various limits in Splunk, e.g. if you just run a simple search

index=*

it will show you 10,000 results max, but if you run

index=* | stats count

it will tell you how many result you have, which can be > 10000