Limited rows returned Splunk CLI for a table

[EricLloyd79]

First, yes, we are using "-maxout 0"
For some reason, on one of our hosts, when we run a particular query that pipes into a table, it only returns around ~3000 rows depending on the 24 hour period we are searching for.
Here are some of the unusual things we've noticed:
(1) Its not a resource issue. We have upgraded the host to 32 GB memory and 12 cores.
(2) If we run the query and just have it return raw events, it works as expected.
(3) The query works on another host in our cluster as expected so query is good.
(4) If we run for a window that is 3 hours or LESS it will return the number of rows as expected. 4 hours or more and it returns only around 3000 rows.
(5) I did notice that around 3 hours, it returns just under 1 million rows. Im wondering if there is a 1 million rows limit for tables in the CLI.
(6) This runs as expected in the Splunk web GUI.

Any ideas?

[EricLloyd79]

As a side note, when I print results as a table, it gets to about 431207 then halts for a second and then starts over at 1 and goes to about 3000.

ex:

431200 20190306 abc 5551212
431201 20190306 abc 5551212
431202 20190306 abc 5551212
431203 20190306 abc 5551212
431204 20190306 abc 5551212
431205 20190306 abc 5551212
431206 20190306 abc 5551212
431207 20190306 abc 5551212
row date fullItemID mdn

---

1 20190306 abc 5551212
2 20190306 abc 5551212
3 20190306 abc 5551212
4 20190306 abc 5551212
5 20190306 abc 5551212
...

[richgalloway]

Can you share the query?

[EricLloyd79]

Sure.

/opt/splunk/bin/splunk search 'sourcetype=xyz url=/foo/bar.jsp kpi01 earliest="03/06/2019:00:00:00" latest="03/06/2019:23:59:59" | rex field=_raw "(?:[^=\n]*=){2}(?P[^ ]+)" | eval date=strftime(_time, "%Y%m%d") | table date, mdn, fullItemID | streamstats count as row | fields row *' -maxout 0 >> output15.log

[EricLloyd79]

I tried it without the regex and it produced the same ~3000 rows only.