All Apps and Add-ons

Splunk DB Connect 3: Increasing dbxoutput row limit

jamesmarlowww
Path Finder

The dbxoutput command has a row limit of 50k rows, where can I increase this threshold?

sh254087
Communicator

By default Splunk displays 100000 rows. To override this and display all the rows, add the parameter maxrows=10000000 (or any lower number) in the dbxquery along with the connection and query parameters.

PLEASE NOTE : It is not always suggested as a best practice to increase or override the limit as it would result in consuming more space and thereby slowing down the searching performance.

FYR - https://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Commands

alt text

0 Karma

kellewic
Path Finder

I had this same problem recently and with some digging found the following in limits.conf

[searchresults]

maxresultrows = <integer>
* Configures the maximum number of events are generated by search commands which grow the size of your result set (such as multikv) or that create events. Other search commands are explicitly controlled in specific stanzas below.
* This limit should not exceed 50000. Setting this limit higher than 50000 causes instability.
* Defaults to 50000.

Setting this higher resolved the issue.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...