loadjob returns only 100 of 150 events


I have a search which returns 150 Events but when I use the loadjob command I can only work with 100 Events of the original search.
Can I configure this anywhere in the splunk settings? Because it makes less sense to search through just a part of the Events.
Does anyone know how to fix this?

Thx in advance.

0 Karma


Where are you getting the numbers 150 and 100? Did you look at the original search and export it to csv to see how many results you really got, or are you relying on the "nnn" events display on the search screen?

Here's one possibility - the verb sort will limit the output to 100 results unless you specifically tell it otherwise by specifying | sort 0. If you have a sort in your initial search, or in the search with the loadjob, then that is your problem.

Other ways you can get exactly 100 is if you do a stats with the values aggregate function. That has a limit of 100 as well.

If that is not the problem, then the limit should have been either 10K or 50K, so those are your most likely culprits.

0 Karma

Super Champion

what does your loadjob look like? i just did a quick test in my local instance with index=_internal earliest=-4h|head=150 and then |loadjob 1533311493.102 events=true and i got 150 events back. i also tried another search with a table that had 150 rows and the loadjob without events=true. there shouldn't be a difference if using a saved search, i wouldn't think.

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...