Splunk Search

HiddenPostProcess 10000 search results limit

Parameshwara
Path Finder

In my advanced XML, an accelerated saved search is initially run that provides results without any limitations in terms of number of results. I've then introduced a HiddenPostProcess sub module which categorises the results into type of messages (error, warning, etc.).

Example:
 1. My accelerated saved search shows there are 100 events for a period
 2. My HiddenPostProcess sub module shows that in the 100 events, there are 60 error messages, 30 warning messages, and 10 alert messages.

Problem:
 1. My accelerated saved search shows there are 11000 events for a period
 2. My HiddenPostProcess sub module shows only details of the first 10000 events (i.e. there are 9000 error messages, 500 warning messages, and 500 alert messages.)

I have tried setting various limits in limits.conf but have not worked. How do i fix this 10000 result limit?

0 Karma

MuS
Legend

Hi Parameshwara

here is an extract from docs about HiddenPostProcess:

  A post process search has an unconfigurable limit of 10,000 raw events that can be passed to it.

You could avoid the limit by using smaller time ranges to construct the data cube before passing them on to the HiddenPostProcess.

Hope this helps.....

Cheers, MuS

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...