topic Re: 'stats' command: limit for values of field 'par_ID' reached. Some values may have been truncated or ignored. in Splunk Search

'stats' command: limit for values of field 'par_ID' reached. Some values may have been truncated or ignored.

harshal_chakran — Mon, 28 Sep 2020 15:34:06 GMT

Hi,

I have a csv file where I list certain column field using the following search query:

sourcetype=csv| rex field=_raw "(\d+,){2}(?\d+)"|stats list(par_ID) as pID

As the file is very big, the events come to be around 600,000. But in stats list field I can see only limited values(i.e.100), and the remaining got truncated. The warning which I can see in job button is:

Is it a limitation of "stats list" command that only 100 values are shown?How can I see all the values in the list??

Re: 'stats' command: limit for values of field 'par_ID' reached. Some values may have been truncated or ignored.

somesoni2 — Mon, 28 Sep 2020 15:34:33 GMT

The command "|stats list(par_ID) as pID" will give all the values for the par_ID field into one single field pID and as your said the no of values could go upto 600,000, which is definitely exceeds the limit of data can be displayed in the single field (1000 bytes).

If you are interested in just listing down the all distinct values for the field par_ID, then I would suggest to use "|stats count by parID | field - count | rename par_ID as pID".

Re: 'stats' command: limit for values of field 'par_ID' reached. Some values may have been truncated or ignored.

harshal_chakran — Mon, 06 Jan 2014 05:02:31 GMT

thanks for the help somesoni2.
I have more than 2 variable to show in result.As I am using count command for one variable, i can't write it for another variable in same query. Please help

Re: 'stats' command: limit for values of field 'par_ID' reached. Some values may have been truncated or ignored.

harshal_chakran — Mon, 06 Jan 2014 10:38:14 GMT

using "stat values" did the magic!!!

Re: 'stats' command: limit for values of field 'par_ID' reached. Some values may have been truncated or ignored.

landen99 — Mon, 25 Aug 2014 17:22:32 GMT

values solved this issue for me as well. values removes duplicate values and sorts the data, so this should be kept in mind when considered this approach.