Splunk Search

Error in "sort" command

abhayneilam
Contributor

I have a search in which I am sorting my data based on "Location" field:

my search | sort Location + desc

My result is having 13,000 lines but I am getting only 10,000 lines as my result along with some msg:

sort is trucating only 10,000 rows

Could you please let me know how to solve this "sort" problem so that it should take all the lines in my result

Please help

Thanks in Advance

Tags (4)
0 Karma
1 Solution

Ayn
Legend

That is no error. A quick look in the docs entry for the sort command (http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/sort ) would have given you this:

sort [<count>] (<sort-by-clause>)+ [desc] 

...

<count>
Syntax: <int> 
Description: Specify the number of results to sort. If no count is specified, the default limit of 10000 is used. If "0" is specified, all results will be returned. 

View solution in original post

Ayn
Legend

That is no error. A quick look in the docs entry for the sort command (http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/sort ) would have given you this:

sort [<count>] (<sort-by-clause>)+ [desc] 

...

<count>
Syntax: <int> 
Description: Specify the number of results to sort. If no count is specified, the default limit of 10000 is used. If "0" is specified, all results will be returned. 
Get Updates on the Splunk Community!

Machine Learning - Assisted Adaptive Thresholding

Let’s talk thresholding. Have you set up static thresholds? Tired of static thresholds triggering false ...

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

  Ready to master Kubernetes and cloud monitoring like the pros?Join Splunk’s Growth Engineering team for an ...

Wrapping Up Cybersecurity Awareness Month

October might be wrapping up, but for Splunk Education, cybersecurity awareness never goes out of season. ...