I have a very basic search query to display ID and it's respective name. There are 1.3 lakhs of data events under the respective sourcetype and all the events have ID and name field in it.
When I run the search query to display the ID and name, only top 10,000 records are displaying.
I have tried to display the results using stats command, table command, chart command and fields + table command. In all of these methods only top 10k records are showing in the statistics section.
But I need all the 1.3 lakh IDs and Names to be displayed so that I can output those data to a lookup file.
Here is my search query
index=main source=splunk_id_name.log sourcetype=id_metric host=xxx
|stats values(name) by id
|sort id
|rename id AS ID name AS Name
Is this the limit of records which can be displayed in Splunk? Or am I missing with any other command?
I need this very urgently. Could anyone please help me on this to get resolved as soon as possible.
