https://community.splunk.com/t5/Splunk-Search/incorrect-number-of-events-in-search-results-when-using-sort/m-p/18738#M2757 <P>@sideview I'm facing with a similar problem maybe you can take a look and give advice? <A href="http://splunk-base.splunk.com/answers/62296/wrong-sorting">http://splunk-base.splunk.com/answers/62296/wrong-sorting</A></P> Wed, 17 Oct 2012 13:39:05 GMT iKate 2012-10-17T13:39:05Z https://community.splunk.com/t5/Splunk-Search/incorrect-number-of-events-in-search-results-when-using-sort/m-p/18735#M2754 <P>Hi. When searching "index=sample | sort host", the search stopped at 10000 events. Is there a limit on number of events returned by the sort command?</P> <P>Thanks.</P> Wed, 29 Dec 2010 13:37:11 GMT https://community.splunk.com/t5/Splunk-Search/incorrect-number-of-events-in-search-results-when-using-sort/m-p/18735#M2754 alextsui 2010-12-29T13:37:11Z https://community.splunk.com/t5/Splunk-Search/incorrect-number-of-events-in-search-results-when-using-sort/m-p/18736#M2755 <P>Yes, there is a default limit of 10000 events for the <CODE>sort</CODE> command. However you can specify your own limit as a parameter, so for instance if you want to specify a limit of 15000 events instead you would do this:</P> <PRE><CODE>index=sample | sort 15000 host </CODE></PRE> <P>More information regarding the <CODE>sort</CODE> command is available here. <A href="http://www.splunk.com/base/Documentation/latest/SearchReference/Sort" rel="nofollow">http://www.splunk.com/base/Documentation/latest/SearchReference/Sort</A></P> Wed, 29 Dec 2010 17:36:42 GMT https://community.splunk.com/t5/Splunk-Search/incorrect-number-of-events-in-search-results-when-using-sort/m-p/18736#M2755 Ayn 2010-12-29T17:36:42Z https://community.splunk.com/t5/Splunk-Search/incorrect-number-of-events-in-search-results-when-using-sort/m-p/18737#M2756 <P>Yes the sort command will only return 10,000 rows by default. You can raise that by specifying a different limit, ie <CODE>| sort 50000 host</CODE> however eventually you may hit other more fundamental limits. </P> <P>And I think you may want to look at this: </P> <P><CODE>| stats count by host</CODE></P> <P>which will chug through all the work and wont hit any kind of limits.</P> Thu, 30 Dec 2010 01:49:41 GMT https://community.splunk.com/t5/Splunk-Search/incorrect-number-of-events-in-search-results-when-using-sort/m-p/18737#M2756 sideview 2010-12-30T01:49:41Z https://community.splunk.com/t5/Splunk-Search/incorrect-number-of-events-in-search-results-when-using-sort/m-p/18738#M2757 <P>@sideview I'm facing with a similar problem maybe you can take a look and give advice? <A href="http://splunk-base.splunk.com/answers/62296/wrong-sorting">http://splunk-base.splunk.com/answers/62296/wrong-sorting</A></P> Wed, 17 Oct 2012 13:39:05 GMT https://community.splunk.com/t5/Splunk-Search/incorrect-number-of-events-in-search-results-when-using-sort/m-p/18738#M2757 iKate 2012-10-17T13:39:05Z