Running Splunk 6.6.4 on Ubuntu, and piping query results (25,000+ rows) to " | outputcsv filename.csv", but the output is consistently limited to 10,000 rows + header row (e.g. "grep -c . filename.csv" returns 10001).
According to documentation, there is no output limit to outputcsv. I can't find anything in limits.conf that seems applicable either.
Am I doing something wrong?
Nevermind. I didn't realize there was a Job alert indicating that "sort is limiting search results to 10000". Removing the |sort from my query resolved the issue.