Do transforming commands have same event limit for post processing?

[chrisdopuch]

Hello,

In the PostProcess Search documentation it says that non-transforming searches which return raw events have a 10,000 return limit. It is unclear if a transforming search still has this limit. If I run a stats command that returns 15,000 rows for example, will post processing still truncate the data?

Documentation:
http://docs.splunk.com/Documentation/Splunk/6.1.2/AdvancedDev/PostProcess

[somesoni2 · Accepted solution]

The PostProcess does not limit the no of records returned for transforming command. The limit is only applicable for non-transforming command returning events in raw format.

Below is a runanywhere poc that I did and the PostProcess was able to receive 76K+ records.

 <view autoCancelInterval="90" decomposeIntentions="false" isPersistable="true" isSticky="false" isVisible="true" objectMode="viewconf" onunloadCancelJobs="true" template="dashboard.html">
  <label>TestPostProcessLimit</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="appHeader"/>
  <module name="SideviewUtils" layoutPanel="appHeader"/>

  <module name="URLLoader" layoutPanel="viewHeader" autoRun="True">
    <module name="Search" layoutPanel="panel_row1_col1"  group="Non-Transforming postprocess" >
      <param name="search">index=_internal earliest=-2d@d | eventstats count as BaseSearchTotal </param>
      <module name="PostProcess" layoutPanel="panel_row1_col1">
        <param name="search">| stats count, max(BaseSearchTotal) </param>
        <module name="Pager" >         
          <module name="Table">
          </module>
        </module>
      </module>
    </module>
    <module name="Search" layoutPanel="panel_row1_col2" group="Transforming postprocess" >
      <param name="search">index=_internal earliest=-2d@d | eventstats count as BaseSearchTotal | stats count, max(BaseSearchTotal) as BaseSearchTotal by _time | eventstats count as TransformCmdTotal
      </param>
      <module name="PostProcess" layoutPanel="panel_row1_col2">
        <param name="search">| stats count, max(BaseSearchTotal)  max(TransformCmdTotal) </param>
        <module name="Pager" >      
          <module name="Table">
          </module>
        </module>
      </module>
    </module>
  </module>
</view>