topic Re: How to overcome append 10k limit without modifying conf file in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-overcome-append-10k-limit-without-modifying-conf-file/m-p/580475#M202232 <P>Are you sure that you cannot convert that append to something else?</P> Mon, 10 Jan 2022 15:27:50 GMT isoutamo 2022-01-10T15:27:50Z How to overcome append 10k limit without modifying conf file https://community.splunk.com/t5/Splunk-Search/How-to-overcome-append-10k-limit-without-modifying-conf-file/m-p/580450#M202227 <P>is it possible to append more than 10k records between 2 index?How to overcome this withou modifying conf file and adding any parameter thro SPL</P> Mon, 10 Jan 2022 13:42:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-overcome-append-10k-limit-without-modifying-conf-file/m-p/580450#M202227 DataOrg 2022-01-10T13:42:19Z Re: How to overcome append 10k limit without modifying conf file https://community.splunk.com/t5/Splunk-Search/How-to-overcome-append-10k-limit-without-modifying-conf-file/m-p/580453#M202228 <P>Break up the append into multiple appends with smaller numbers of events</P> Mon, 10 Jan 2022 13:52:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-overcome-append-10k-limit-without-modifying-conf-file/m-p/580453#M202228 ITWhisperer 2022-01-10T13:52:05Z Re: How to overcome append 10k limit without modifying conf file https://community.splunk.com/t5/Splunk-Search/How-to-overcome-append-10k-limit-without-modifying-conf-file/m-p/580459#M202229 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp;the append result has 33k records. how to spilt it and it may chance to increase in future?</P> Mon, 10 Jan 2022 14:13:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-overcome-append-10k-limit-without-modifying-conf-file/m-p/580459#M202229 DataOrg 2022-01-10T14:13:52Z Re: How to overcome append 10k limit without modifying conf file https://community.splunk.com/t5/Splunk-Search/How-to-overcome-append-10k-limit-without-modifying-conf-file/m-p/580461#M202230 <P>It depends on what your subsearch is - can you split by time for example? The main thing you need to split is the initial part of the subsearch. If you can't use time, what about filtering the search on other fields such as host or source.</P> Mon, 10 Jan 2022 14:29:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-overcome-append-10k-limit-without-modifying-conf-file/m-p/580461#M202230 ITWhisperer 2022-01-10T14:29:37Z Re: How to overcome append 10k limit without modifying conf file https://community.splunk.com/t5/Splunk-Search/How-to-overcome-append-10k-limit-without-modifying-conf-file/m-p/580475#M202232 <P>Are you sure that you cannot convert that append to something else?</P> Mon, 10 Jan 2022 15:27:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-overcome-append-10k-limit-without-modifying-conf-file/m-p/580475#M202232 isoutamo 2022-01-10T15:27:50Z