https://community.splunk.com/t5/Splunk-Search/What-is-the-effect-of-maxresultrows-for-stats-in-limits-conf/m-p/150809#M42266 <P>maxresultrows for stats * does not * restrict the number of rows in the result. However, it determines the number of rows present in the memory. If the result size goes over &gt; the maxres and if our memusage &gt; max_mem_usage then splunk save it to disk. 6.0.5 docs mentioned about it. </P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.0.5/Admin/Limitsconf" target="_blank">http://docs.splunk.com/Documentation/Splunk/6.0.5/Admin/Limitsconf</A><BR /> maxresultrows = <INTEGER><BR /> * Maximum number of rows allowed in the process memory. <BR /> * When the search process exceeds max_mem_usage_mb and maxresultrows, data is spilled out to the disk<BR /> * If not specified, defaults to searchresults::maxresultrows (which is by default 50000).</INTEGER></P> Mon, 28 Sep 2020 18:17:06 GMT cwl 2020-09-28T18:17:06Z https://community.splunk.com/t5/Splunk-Search/What-is-the-effect-of-maxresultrows-for-stats-in-limits-conf/m-p/150807#M42264 <P>Hi,</P> <P>My understanding about the configuration parameter "maxresultrows" for [stats] is for limiting the number of stats result up to 50,000 by default.</P> <P><STRONG>limits.conf.spec</STRONG></P> <PRE><CODE>[stats|sistats] maxresultrows = &lt;integer&gt; * Maximum number of result rows to create. * If not specified, defaults to searchresults::maxresultrows (which is by default 50000). </CODE></PRE> <P>However, when I run a search, "... | stats count by ipaddress", the result actually exceed far more than 50,000.<BR /> Is this maxresultrows for stats table row count or other purpose?</P> <P>I thought I would see some warning or error message with stats results with more than 50,000.<BR /> e.g. stats count by ipaddress, where unique ipaddresses are more than 50,000.</P> <P>Any comment regarding this parameter is appreciated.<BR /> Thank you in advance.</P> Fri, 14 Feb 2014 12:19:35 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-effect-of-maxresultrows-for-stats-in-limits-conf/m-p/150807#M42264 melonman 2014-02-14T12:19:35Z https://community.splunk.com/t5/Splunk-Search/What-is-the-effect-of-maxresultrows-for-stats-in-limits-conf/m-p/150808#M42265 <P>That is controlling the timing to swap the partial calculation to the disk. it is not limiting the max number of actual rows to be returned.</P> <P>"When the search process exceeds max_mem_usage_mb and maxresultrows, data is spilled out to the disk"</P> Mon, 28 Sep 2020 18:17:03 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-effect-of-maxresultrows-for-stats-in-limits-conf/m-p/150808#M42265 Splunk_Shinobi 2020-09-28T18:17:03Z https://community.splunk.com/t5/Splunk-Search/What-is-the-effect-of-maxresultrows-for-stats-in-limits-conf/m-p/150809#M42266 <P>maxresultrows for stats * does not * restrict the number of rows in the result. However, it determines the number of rows present in the memory. If the result size goes over &gt; the maxres and if our memusage &gt; max_mem_usage then splunk save it to disk. 6.0.5 docs mentioned about it. </P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.0.5/Admin/Limitsconf" target="_blank">http://docs.splunk.com/Documentation/Splunk/6.0.5/Admin/Limitsconf</A><BR /> maxresultrows = <INTEGER><BR /> * Maximum number of rows allowed in the process memory. <BR /> * When the search process exceeds max_mem_usage_mb and maxresultrows, data is spilled out to the disk<BR /> * If not specified, defaults to searchresults::maxresultrows (which is by default 50000).</INTEGER></P> Mon, 28 Sep 2020 18:17:06 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-effect-of-maxresultrows-for-stats-in-limits-conf/m-p/150809#M42266 cwl 2020-09-28T18:17:06Z