Splunk Search

Search result limit

corehan
Explorer

Hello dears,

How can i change search result limit ? At this moment, max 10K line shown..

 

Labels (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Why do you need to increase the lines shown? There are various limits in Splunk, e.g. if you just run a simple search

index=*

it will show you 10,000 results max, but if you run

index=*
| stats count

it will tell you how many result you have, which can be > 10000

 

0 Karma

hoaxm3
Path Finder

10k exactly is usually due to a subsearch or the sort command. If sort, try changing sort to 'sort - 0'. If subsearch, look at the limits.conf file and increase the maxout integer.

maxout = x

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf#.5Bsubsearch.5D

0 Karma
Get Updates on the Splunk Community!

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...

UCC Framework: Discover Developer Toolkit for Building Technology Add-ons

The Next-Gen Toolkit for Splunk Technology Add-on Development The Universal Configuration Console (UCC) ...

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...