Splunk Search

Increasing rows returned from STAT \ CHART queries

apackard
Engager

When I run a CHART or STAT query, and the query returns more than 50 rows the output is truncated with the following:-

[and xx more values]

Is there anyway to increase the number of rows returned?

Tags (2)
0 Karma

sideview
SplunkTrust
SplunkTrust

This is a common mistake. You're running searches like

stats values(foo)

when you should be running

stats count by foo

instead. The former will return just one row, with "values(foo)" as a multivalue field. However it is designed for situations when there are only a few values, so it truncates at 50. The latter on the other hand will display any number of rows - hundreds, thousands, millions, and never truncate.

Similarly, if you find yourself doing stats values(foo) by bar, intending to get unique combinations of foo with bar, just do stats count by foo bar.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You could also just do top 0 foo bar.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Synthetic Monitoring - Resolved Incident on Detector Alerts

We’ve discovered a bug that affected the auto-clear of Synthetic Detectors in the Splunk Synthetic Monitoring ...

Video | Tom’s Smartness Journey Continues

Remember Splunk Community member Tom Kopchak? If you caught the first episode of our Smartness interview ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud? Learn how unique features like ...