Splunk Search

Row limit for custom commands

gpburgett
Splunk Employee
Splunk Employee

I've got a custom command that we're running over a large set of data. When I just run the part of the query up to right before the custom command, all of the data comes back. But as soon as I apply my command, only the first 50,000 rows are returned to the screen. Looking at the docks, I found that there is a "maxinputs" parameter in commands.conf, which I increased, and that searchresults::maxresultsrows in limits.conf also can have an effect, so I increased that as well. However, the search still only returns the first 50,000 lines. Is there another configuration that I'm missing that needs to be adjusted? Or is this a fixed limit that Splunk applies?

Tags (1)

gwobben
Communicator

This is probably not relevant any more but for anyone who's looking for this... I had chunked = true in my commands.conf and I got only 50,000 results. After setting this to false I got back all my results.

0 Karma
Get Updates on the Splunk Community!

Cultivate Your Career Growth with Fresh Splunk Training

Growth doesn’t just happen—it’s nurtured. Like tending a garden, developing your Splunk skills takes the right ...

Introducing a Smarter Way to Discover Apps on Splunkbase

We’re excited to announce the launch of a foundational enhancement to Splunkbase: App Tiering.  Because we’ve ...

How to Send Splunk Observability Alerts to Webex teams in Minutes

As a Developer Evangelist at Splunk, my team and I are constantly tinkering with technology to explore its ...