Splunk Search

Search result limit

corehan
Explorer

Hello dears,

How can i change search result limit ? At this moment, max 10K line shown..

 

Labels (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Why do you need to increase the lines shown? There are various limits in Splunk, e.g. if you just run a simple search

index=*

it will show you 10,000 results max, but if you run

index=*
| stats count

it will tell you how many result you have, which can be > 10000

 

0 Karma

hoaxm3
Path Finder

10k exactly is usually due to a subsearch or the sort command. If sort, try changing sort to 'sort - 0'. If subsearch, look at the limits.conf file and increase the maxout integer.

maxout = x

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf#.5Bsubsearch.5D

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...