How do I increase the limit on events returned when using cli search?

[SK110176]

When running a splunk search from the cli, the maximum number of events returned is 100. How do I increase this limit?

[V_at_Splunk · Accepted solution]

-maxout 999 (or your preferred number)

[Marcin · Accepted solution]

I think what you are looking for is "-maxout NUM", which changes the limit of returned results from 100 to NUM.

[Stephen_Sorkin · Accepted solution]

New in 4.1, you can set -maxout 0, which means "unlimited." This is useful for streaming data to another processing system or to a file.

[kevintelford]

Awesome!

:)

[Stephen_Sorkin]

csv is unlimited in 4.2. table remains limited.

[kevintelford]

As of 4.1.5 using -maxout 0 will yield unlimited results if your -ouput flag is set to 'raw' or 'rawdata', if it is set to 'csv' or 'table' it will be limited to 50k (plus one line for the header).

[Marcin · Accepted solution]

I think what you are looking for is "-maxout NUM", which changes the limit of returned results from 100 to NUM.

[V_at_Splunk · Accepted solution]

-maxout 999 (or your preferred number)