outputcsv limiting outputs to 10,000 rows

[gordo32]

Running Splunk 6.6.4 on Ubuntu, and piping query results (25,000+ rows) to " | outputcsv filename.csv", but the output is consistently limited to 10,000 rows + header row (e.g. "grep -c . filename.csv" returns 10001).

According to documentation, there is no output limit to outputcsv. I can't find anything in limits.conf that seems applicable either.

Am I doing something wrong?

[gordo32]

Nevermind. I didn't realize there was a Job alert indicating that "sort is limiting search results to 10000". Removing the |sort from my query resolved the issue.

[493669]

are you using sort command if yes then use like:

...|sort limit=0

As outputcsv does not have any results limits

[493669]

instead of removing sort you can use it with limit=0 which will not limit your data..

..|sort 0 <fieldname>