HiddenPostProcess 10000 search results limit

[Parameshwara]

In my advanced XML, an accelerated saved search is initially run that provides results without any limitations in terms of number of results. I've then introduced a HiddenPostProcess sub module which categorises the results into type of messages (error, warning, etc.).

Example:
 1. My accelerated saved search shows there are 100 events for a period
 2. My HiddenPostProcess sub module shows that in the 100 events, there are 60 error messages, 30 warning messages, and 10 alert messages.

Problem:
 1. My accelerated saved search shows there are 11000 events for a period
 2. My HiddenPostProcess sub module shows only details of the first 10000 events (i.e. there are 9000 error messages, 500 warning messages, and 500 alert messages.)

I have tried setting various limits in limits.conf but have not worked. How do i fix this 10000 result limit?

[MuS]

Hi Parameshwara

here is an extract from docs about HiddenPostProcess:

  A post process search has an unconfigurable limit of 10,000 raw events that can be passed to it.

You could avoid the limit by using smaller time ranges to construct the data cube before passing them on to the HiddenPostProcess.

Hope this helps.....

Cheers, MuS