https://community.splunk.com/t5/Splunk-Search/Why-are-search-results-cut-off-at-10-000-in-Splunk-Web-and-10/m-p/233278#M69252 <P>You should post a new question.</P> Wed, 29 Jun 2016 17:40:41 GMT woodcock 2016-06-29T17:40:41Z https://community.splunk.com/t5/Splunk-Search/Why-are-search-results-cut-off-at-10-000-in-Splunk-Web-and-10/m-p/233273#M69247 <P>When searching a large data set through Splunk Web, results are capped at 10,000 events. When searching through the REST API on the same search head, results are sometimes cut off at 10,000 events and sometimes at 20,000.</P> <P>How can I retrieve the full results of a search?</P> Tue, 28 Jun 2016 18:14:21 GMT https://community.splunk.com/t5/Splunk-Search/Why-are-search-results-cut-off-at-10-000-in-Splunk-Web-and-10/m-p/233273#M69247 sjodle 2016-06-28T18:14:21Z https://community.splunk.com/t5/Splunk-Search/Why-are-search-results-cut-off-at-10-000-in-Splunk-Web-and-10/m-p/233274#M69248 <P>Are you using <CODE>sort</CODE>? It defaults to 10K but you can unlimit it by using <CODE>sort 0</CODE>. Many splunk commands limit the output of your results with a silly low-limit default. Backtrack through your commands and find the culprit and unlimit it.</P> Tue, 28 Jun 2016 20:44:24 GMT https://community.splunk.com/t5/Splunk-Search/Why-are-search-results-cut-off-at-10-000-in-Splunk-Web-and-10/m-p/233274#M69248 woodcock 2016-06-28T20:44:24Z https://community.splunk.com/t5/Splunk-Search/Why-are-search-results-cut-off-at-10-000-in-Splunk-Web-and-10/m-p/233275#M69249 <P>That was it, thanks. Added "0" between "sort" and my field name, and the limit went away.</P> Tue, 28 Jun 2016 20:58:09 GMT https://community.splunk.com/t5/Splunk-Search/Why-are-search-results-cut-off-at-10-000-in-Splunk-Web-and-10/m-p/233275#M69249 sjodle 2016-06-28T20:58:09Z https://community.splunk.com/t5/Splunk-Search/Why-are-search-results-cut-off-at-10-000-in-Splunk-Web-and-10/m-p/233276#M69250 <P>I feel your pain.</P> Tue, 28 Jun 2016 21:00:05 GMT https://community.splunk.com/t5/Splunk-Search/Why-are-search-results-cut-off-at-10-000-in-Splunk-Web-and-10/m-p/233276#M69250 woodcock 2016-06-28T21:00:05Z https://community.splunk.com/t5/Splunk-Search/Why-are-search-results-cut-off-at-10-000-in-Splunk-Web-and-10/m-p/233277#M69251 <P>Even after removing the sort limit, results from the REST API still seem to be capped, this time at 500,000.</P> Wed, 29 Jun 2016 17:35:51 GMT https://community.splunk.com/t5/Splunk-Search/Why-are-search-results-cut-off-at-10-000-in-Splunk-Web-and-10/m-p/233277#M69251 sjodle 2016-06-29T17:35:51Z https://community.splunk.com/t5/Splunk-Search/Why-are-search-results-cut-off-at-10-000-in-Splunk-Web-and-10/m-p/233278#M69252 <P>You should post a new question.</P> Wed, 29 Jun 2016 17:40:41 GMT https://community.splunk.com/t5/Splunk-Search/Why-are-search-results-cut-off-at-10-000-in-Splunk-Web-and-10/m-p/233278#M69252 woodcock 2016-06-29T17:40:41Z https://community.splunk.com/t5/Splunk-Search/Why-are-search-results-cut-off-at-10-000-in-Splunk-Web-and-10/m-p/233279#M69253 <P>OK, will do.</P> Wed, 29 Jun 2016 17:45:00 GMT https://community.splunk.com/t5/Splunk-Search/Why-are-search-results-cut-off-at-10-000-in-Splunk-Web-and-10/m-p/233279#M69253 sjodle 2016-06-29T17:45:00Z