Splunk Enterprise

Why my search query returns only top 10k records?

akarivaratharaj
Communicator

I have a very basic search query to display ID and it's respective name. There are 1.3 lakhs of data events under the respective sourcetype and all the events have ID and name field in it.

When I run the search query to display the ID and name, only top 10,000 records are displaying.

I have tried to display the results using stats command, table command, chart command and  fields + table command. In all of these methods only top 10k records are showing in the statistics section.

But I need all the 1.3 lakh IDs and Names to be displayed so that I can output those data to a lookup file.

Here is my search query

index=main source=splunk_id_name.log sourcetype=id_metric host=xxx
|stats values(name) by id
|sort id
|rename id AS ID name AS Name

 

Is this the limit of records which can be displayed in Splunk? Or am I missing with any other command?


I need this very urgently. Could anyone please help me on this to get resolved as soon as possible.

Labels (1)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

sort has a default limit of 10000 try

| sort 0 id

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

sort has a default limit of 10000 try

| sort 0 id

akarivaratharaj
Communicator

Thankyou @ITWhisperer  it's worked for me.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...