Splunk Search

Hunk search only retrieves 1000 events. How to modify this limit?

benoitleroux
Explorer

Using Hunk, each search retrieves only 1000 results. Is this set in the etc/system/default/limits.conf? If so which key is it? I tried to modify some of them without success.

Tags (2)
1 Solution

rdagan_splunk
Splunk Employee
Splunk Employee

Try this: In limits.conf, change the following line. Default is 1000.
max_events_per_bucket = 1000

View solution in original post

benoitleroux
Explorer

Thanks it does affect it. max_events_per_bucket was not present in the fresh installed.

0 Karma

rdagan_splunk
Splunk Employee
Splunk Employee

Try this: In limits.conf, change the following line. Default is 1000.
max_events_per_bucket = 1000

benoitleroux
Explorer

Thanks it does affect it. max_events_per_bucket was not present etc/system/default/limits.conf in the fresh installed of last version.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...