How can I see if events were truncated in Splunk 6.x?

[uritobol115]

Hi,

In Splunk 5.x if events were truncated (e.g subsearch with more than 50000 events) there was a banner that says the events were truncated. How can I see it in version 6.x?

[martin_mueller · Accepted solution]

There's a green info icon on the Job button, indicating a message. Click it and you can see

[subsearch]: Subsearch produced 86400 results, truncating to maxout 50000.

when you run this dummy query:

| stats count | append [gentimes start=-1 increment=1s]

In SimpleXML dashboards you may need to click the Inspect Job button to see the message.