loadjob returns only 100 of 150 events


I have a search which returns 150 Events but when I use the loadjob command I can only work with 100 Events of the original search.
Can I configure this anywhere in the splunk settings? Because it makes less sense to search through just a part of the Events.
Does anyone know how to fix this?

Thx in advance.

0 Karma


Where are you getting the numbers 150 and 100? Did you look at the original search and export it to csv to see how many results you really got, or are you relying on the "nnn" events display on the search screen?

Here's one possibility - the verb sort will limit the output to 100 results unless you specifically tell it otherwise by specifying | sort 0. If you have a sort in your initial search, or in the search with the loadjob, then that is your problem.

Other ways you can get exactly 100 is if you do a stats with the values aggregate function. That has a limit of 100 as well.

If that is not the problem, then the limit should have been either 10K or 50K, so those are your most likely culprits.

0 Karma

Super Champion

what does your loadjob look like? i just did a quick test in my local instance with index=_internal earliest=-4h|head=150 and then |loadjob 1533311493.102 events=true and i got 150 events back. i also tried another search with a table that had 150 rows and the loadjob without events=true. there shouldn't be a difference if using a saved search, i wouldn't think.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...