topic Re: Limits of events returned in Splunk Search

Limits of events returned

AleCanzo — Thu, 20 Nov 2025 09:18:17 GMT

Hi guys, is there a limit of the number's events returned in splunk?
I'm trying to run a query with inputlookup, but i see only 50_000 results, while my lookup has more results.
The limit.conf file seems to be useless, any suggestions?
Thanks 🙂

Re: Limits of events returned

gcusello — Thu, 20 Nov 2025 09:28:27 GMT

Hi @AleCanzo ,

if it is a custom csv lookup, try to use a KV-store that shouldn't have this limit.

Ciao.

Giuseppe

Re: Limits of events returned

livehybrid — Thu, 20 Nov 2025 10:30:24 GMT

Hi @AleCanzo

As far as I know inputlookup has a default max output of 1000000000 rows (see https://help.splunk.com/en/splunk-enterprise/spl-search-reference/9.3/search-commands/inputlookup )

Im certainly able to use inputlookup with a lookup which has over 600,000 rows without issue or modification to limits.conf

Are you using any other commands in your search which could be limiting? e.g. rare / table / stats / top

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Limits of events returned

AleCanzo — Thu, 20 Nov 2025 10:55:19 GMT

Hi @livehybrid,
Let me explain better. I have SOAR and Enterprise on Cloud. I'm trying to get, via "run query" in a playbook, some resultst from SIEM to SOAR. The query is a simple | inputlookup command on a csv. However i don't get all the results. Where's the problem? Splunk Cloud? the request from SOAR?
Thanks 🙂

Re: Limits of events returned

ITWhisperer — Thu, 20 Nov 2025 10:58:16 GMT

There is a limit on subsearches - how are you using inputlookup in your full search?

Re: Limits of events returned

PickleRick — Thu, 20 Nov 2025 19:08:02 GMT

Depends how you're using the inputlookup. A "nice" number suggests you're hitting one of splunk's limits which I suspect comes from using inputlookup within a subsearch.

You can use inputlookup with append=t but not every use case can be expressed this way.