Reporting
Highlighted

loadjob limits 1000lines

Contributor

hello
i am trying to load events from a saved search which contains 10000+ events
|load pid events=t
but this only return 1000 rows
how could i break the limitation?
thanks

Tags (2)
Highlighted

Re: loadjob limits 1000lines

Contributor

Hi Eva,
I'm having the same issue. Did you get this resolved?

Steve

Highlighted

Re: loadjob limits 1000lines

Path Finder

Hi,

Was this question answered? I am looking at a similar problem.

Thanks

Highlighted

Re: loadjob limits 1000lines

SplunkTrust
SplunkTrust

|loadjob SID events=t

0 Karma
Highlighted

Re: loadjob limits 1000lines

Path Finder

Same problem, even with DalJeanis's suggestion... Any fix?

0 Karma
Highlighted

Re: loadjob limits 1000lines

has anyone figured this out since 2013?

0 Karma
Highlighted

Re: loadjob limits 1000lines

Splunk Employee
Splunk Employee

If you append a table command with the field list you are interested in it may work around your issue.

0 Karma
Highlighted

Re: loadjob limits 1000lines

Contributor

To verify your suggestion, I tried this but can not repeat my issue again.

|loadjob SID events=t

It returned more than 1000 events. Splunk version 6.4
I forgot why I used "load" and "pid", and what I searched 3 years ago.
Any one have the same issue, could you plz post your search conditions?

0 Karma
Highlighted

Re: loadjob limits 1000lines

Splunk Employee
Splunk Employee

The issue was likely fixed in a more recent version of splunk. The table command was just a workaround because it transforms event data into results data and thus worked around the bug in loading all of the events data.

0 Karma
Highlighted

Re: loadjob limits 1000lines

Contributor

Same issue here.... 18,000 events, only 1,000 returned using loadjob.

0 Karma