loadjob returns only 100 of 150 events

[igschloessl]

I have a search which returns 150 Events but when I use the loadjob command I can only work with 100 Events of the original search.
Can I configure this anywhere in the splunk settings? Because it makes less sense to search through just a part of the Events.
Does anyone know how to fix this?

Thx in advance.

[DalJeanis]

Where are you getting the numbers 150 and 100? Did you look at the original search and export it to csv to see how many results you really got, or are you relying on the "nnn" events display on the search screen?

Here's one possibility - the verb sort will limit the output to 100 results unless you specifically tell it otherwise by specifying | sort 0. If you have a sort in your initial search, or in the search with the loadjob, then that is your problem.

Other ways you can get exactly 100 is if you do a stats with the values aggregate function. That has a limit of 100 as well.

If that is not the problem, then the limit should have been either 10K or 50K, so those are your most likely culprits.

[cmerriman]

what does your loadjob look like? i just did a quick test in my local instance with index=_internal earliest=-4h|head=150 and then |loadjob 1533311493.102 events=true and i got 150 events back. i also tried another search with a table that had 150 rows and the loadjob without events=true. there shouldn't be a difference if using a saved search, i wouldn't think.