topic Re: Why is there a 10000 rows limit? in Splunk Search

Why is there a 10000 rows limit?

jiaqya — Wed, 20 Mar 2019 15:07:55 GMT

I ran a search which should show more than 10000 rows, but I get only 10000 rows back on the result.
Is this a limitation?

Re: Why is there a 10000 rows limit?

vnravikumar — Wed, 20 Mar 2019 15:14:21 GMT

Are you using sort command? It defaults results to 10K, but you can unlimit it by using sort 0.

Re: Why is there a 10000 rows limit?

aholzer — Wed, 20 Mar 2019 15:18:04 GMT

You are likely running a join or something similar. All the limits are configured under limits.conf. Be very careful about changing them though because they can have a big impact on performance!

There are ways of doing joins without the "join" command. I suggest you post the search you are trying to perform so that someone can help you build out the more efficient search without the join.

Hope this helps

Re: Why is there a 10000 rows limit?

jiaqya — Wed, 20 Mar 2019 15:20:36 GMT

Thanks, it was the sort usage.. its fixed now..

Re: Why is there a 10000 rows limit?

jiaqya — Wed, 20 Mar 2019 15:21:08 GMT

thanks for your reply, it was the usage of sort which was causing it..

Re: Why is there a 10000 rows limit?

anil1432 — Thu, 10 Jun 2021 06:15:06 GMT

Can you please solve the query .

Issue with limits.conf

platform_str=if(platform="0","Android",if(platform="1","iPhone",if(platform="2","Web (Android)",if(platform="3","Web (iPhone)","Unknown"))))| stats count(easy_id) as basedUserCount sum(retentionFlg) as retentionUserCount by platform_str | addcoltotals labelfield=platform_str | eval customerChurnRate=(basedUserCount - retentionUserCount) / basedUserCount * 100 |eval baseUserListDateFrom = strftime(relative_time(now(),"-60d@d"), "%Y/%m/%d")." 00:00:00" |eval baseUserListDateTo = strftime(relative_time(now(),"-31d@d"), "%Y/%m/%d")." 23:59:59" |eval compareUserListDateFrom = strftime(relative_time(now(),"-30d@d"), "%Y/%m/%d") ." 00:00:00" |eval compareUserListDateTo = strftime(relative_time(now(),"-1d@d"), "%Y/%m/%d") ." 23:59:59" | table baseUserListDateFrom baseUserListDateTo compareUserListDateFrom compareUserListDateTo platform_str basedUserCount retentionUserCount customerChurnRate

Re: Why is there a 10000 rows limit?

acrif — Tue, 20 Jun 2023 03:41:29 GMT

Hi, how did you fixed the issue?

Re: Why is there a 10000 rows limit?

drabbit — Wed, 28 Jun 2023 12:51:38 GMT

and how do I export more than 10.000 rows if I want them sorted by timestamp? That is a necessary sort because Splunk default behaviour is to sort rows in wrong order.

Re: Why is there a 10000 rows limit?

ITWhisperer — Wed, 28 Jun 2023 13:09:13 GMT

Use reverse instead

| reverse

Re: Why is there a 10000 rows limit?

drabbit — Tue, 04 Jul 2023 16:44:11 GMT

reverse is bugged. Big blocks of log lines are several hours shifted away from where they should be. I recommend to never use it.

Re: Why is there a 10000 rows limit?

isoutamo — Tue, 04 Jul 2023 16:47:51 GMT

You should use "sort 0" instead of sort. See more https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Sort

r. Ismo

Re: Why is there a 10000 rows limit?

drabbit — Tue, 04 Jul 2023 16:53:12 GMT

thanks! That solves the issue. And "sort 0 _time" doesn't have the flaw that reverse has.