topic Increasing rows returned from STAT \ CHART queries in Splunk Search

Increasing rows returned from STAT \ CHART queries

apackard — Fri, 05 Jul 2013 16:05:10 GMT

When I run a CHART or STAT query, and the query returns more than 50 rows the output is truncated with the following:-

[and xx more values]

Is there anyway to increase the number of rows returned?

Re: Increasing rows returned from STAT \ CHART queries

sideview — Fri, 05 Jul 2013 18:51:56 GMT

This is a common mistake. You're running searches like

stats values(foo)

when you should be running

stats count by foo

instead. The former will return just one row, with "values(foo)" as a multivalue field. However it is designed for situations when there are only a few values, so it truncates at 50. The latter on the other hand will display any number of rows - hundreds, thousands, millions, and never truncate.

Similarly, if you find yourself doing stats values(foo) by bar, intending to get unique combinations of foo with bar, just do stats count by foo bar.

Re: Increasing rows returned from STAT \ CHART queries

martin_mueller — Fri, 05 Jul 2013 19:33:37 GMT

You could also just do top 0 foo bar.