Splunk Search

Row limit for custom commands

gpburgett
Splunk Employee
Splunk Employee

I've got a custom command that we're running over a large set of data. When I just run the part of the query up to right before the custom command, all of the data comes back. But as soon as I apply my command, only the first 50,000 rows are returned to the screen. Looking at the docks, I found that there is a "maxinputs" parameter in commands.conf, which I increased, and that searchresults::maxresultsrows in limits.conf also can have an effect, so I increased that as well. However, the search still only returns the first 50,000 lines. Is there another configuration that I'm missing that needs to be adjusted? Or is this a fixed limit that Splunk applies?

Tags (1)

gwobben
Communicator

This is probably not relevant any more but for anyone who's looking for this... I had chunked = true in my commands.conf and I got only 50,000 results. After setting this to false I got back all my results.

0 Karma
Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...