Splunk Search

Limited rows returned Splunk CLI for a table


First, yes, we are using "-maxout 0"
For some reason, on one of our hosts, when we run a particular query that pipes into a table, it only returns around ~3000 rows depending on the 24 hour period we are searching for.
Here are some of the unusual things we've noticed:
(1) Its not a resource issue. We have upgraded the host to 32 GB memory and 12 cores.
(2) If we run the query and just have it return raw events, it works as expected.
(3) The query works on another host in our cluster as expected so query is good.
(4) If we run for a window that is 3 hours or LESS it will return the number of rows as expected. 4 hours or more and it returns only around 3000 rows.
(5) I did notice that around 3 hours, it returns just under 1 million rows. Im wondering if there is a 1 million rows limit for tables in the CLI.
(6) This runs as expected in the Splunk web GUI.

Any ideas?

0 Karma


As a side note, when I print results as a table, it gets to about 431207 then halts for a second and then starts over at 1 and goes to about 3000.


431200 20190306 abc 5551212
431201 20190306 abc 5551212
431202 20190306 abc 5551212
431203 20190306 abc 5551212
431204 20190306 abc 5551212
431205 20190306 abc 5551212
431206 20190306 abc 5551212
431207 20190306 abc 5551212
row date fullItemID mdn

1 20190306 abc 5551212
2 20190306 abc 5551212
3 20190306 abc 5551212
4 20190306 abc 5551212
5 20190306 abc 5551212

0 Karma


Can you share the query?

If this reply helps you, Karma would be appreciated.
0 Karma



/opt/splunk/bin/splunk search 'sourcetype=xyz url=/foo/bar.jsp kpi01 earliest="03/06/2019:00:00:00" latest="03/06/2019:23:59:59" | rex field=_raw "(?:[^=\n]*=){2}(?P[^ ]+)" | eval date=strftime(_time, "%Y%m%d") | table date, mdn, fullItemID | streamstats count as row | fields row *' -maxout 0 >> output15.log

0 Karma


I tried it without the regex and it produced the same ~3000 rows only.

0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...