topic Splunk Search results limit 4999 in Splunk Search

Splunk Search results limit 4999

kc_prane — Wed, 08 Nov 2023 19:59:02 GMT

Hello,

Currently, I am using the append command to combine two queries and tabulate the results, but I see only 4999 transactions. Is there any way I can get full results? Thanks in advance!

Re: Splunk Search results limit 4999

bowesmana — Wed, 08 Nov 2023 22:35:17 GMT

append and subsearches have limitations and limits defined in limits.conf, so you cannot override these, but that number seems an odd number.

What is your search - there are often alternatives to append and a subsearch.

Can you share your search

Re: Splunk Search results limit 4999

kc_prane — Thu, 09 Nov 2023 02:00:17 GMT

Hi @bowesman Thanks for the reply Please find the below snap shots for the query. I had masked my base search.. fyi my base search is same for the subsearch as well.

Re: Splunk Search results limit 4999

gcusello — Thu, 09 Nov 2023 07:16:51 GMT

Hi @kc_prane ,

using a screenshot and masking your search we cannot help you!

@bowesmana was saying that probably you don't need to use append and you can put both the searches in the main search, in this way you don't have any limit.

Ciao.

Giuseppe

Re: Splunk Search results limit 4999

bowesmana — Thu, 09 Nov 2023 23:20:54 GMT

OK, so a lot going on here...

You have two searches that look similar - not sure if they are searching the same data set, but in order to diagnose this you should do a number of things. You are also using the transaction command that also has limitations and can cause data not to appear if you hit those limitations - and you will not know about it.

I suggest you validate first search 1 and see how many results you expect and then run search 2 (the appended data) and determine how many you see then.

If you do not see 1 + 2 in the combined search, you are hitting some memory issue.

I suspect, but cannot say exactly, that you could remove both the append and the use of transaction and just use stats.

Are the two masked search data sets the same or different?