Splunk Search

Impact of Increasing the limit of stats list() from 100 to say 1,00,000

ahmadshakir1952
Explorer

I am using stats list() for a use case. But the data I am dealing is lot more, than the limit that is set to =100 in limit.conf for stats list() function. I thought about using Stats Values(), but as it breaks the event order, I am stuck with stats list().

I am thinking of increasing the limit of stats list() from 100 to say 1,00,000 for example.

What I am concerned about is, will there be any performance issue if I increase the stats list() or will there be any problem if I increase it? Just to be on the safe side.

Any help would be appreciated.

0 Karma

to4kawa
Ultra Champion
| makeresults count=100000
| streamstats count
| stats list(count) as list_100000

Hi, @ahmadshakir1952
As I run this query, It is certainly omitted.

I don't know your query. What's your query?
There may be alternatives.

0 Karma

soumyasaha25
Contributor

On your question about the performance impact, you might end up running into OOM issues and your search performance might also get degraded, as suggested by @to4kawa there might be alternatives available, if you can post your query and some mockup data and the desired output we can try to help you out

0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...