Splunk Search

In sort command I want to avoid limit of 10,000 rows without using attribute "count=0". Is there any setting for this in any conf file ?

abhinav_maxonic
Path Finder

When I sort my data by some field, by default its has limit of 10,000 rows. If I use attribute count=0 along with sort command it removes this limit. I want to know if I can do any settings or change any parameter in any conf file, so that next time I don't have to use "count=0" in order to avoid the limit of 10,000 rows.

woodcock
Esteemed Legend

It is a common best practice to ALWAYS use sort 0 instead of sort because of this silly default trimming value.
I am unaware of any way to change this default.

abhinav_maxonic
Path Finder

Np. Thanks for answering.

0 Karma

inventsekar
SplunkTrust
SplunkTrust

well, there is a limits.conf file, but its not having any options for sort command.

one more thing - you were saying "sort count=0"

actually, we need not include "count=".. just add a "0" after sort.

so, to get all results we have to run
- for example to sort by host
<source> | sort 0 host

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

abhinav_maxonic
Path Finder

Even I didn't see any parameter in limits.conf which I can use to remove this limit with sort command.

inventsekar
SplunkTrust
SplunkTrust

from splunk's developer point of view, this does not require a config file editing, processing the config file, etc.,.. after "sort", all you need to add is just "a space, 0, another space" ("0").

i think the developers usually do this as a general a way of making the users to learn the commands and tools (the linux commands and tools, for example vi, sed .. all full of these small twists and turns 😉 )

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...