Splunk |search limited to 1000 entries

[mkroczak]

Hi there,

I'm just a basic user of Splunk in my company and I have 0 experience with programming or SQL please don't go rough on me.

I'm creating queries for extracting data for specific entries. For example:

|search LOTID = 19ADET165T0 OR 19ADET1E666 OR 19ADET1E838 OR 19ADET1FT58 OR 19ADET1G341 OR 19ADET1G511 OR 19ADET1G896 OR 19ADET1G898 OR 19ADET1G90T				

Which with additional conditions will return results for these entries. 

Following this method I can only create single query for maximum of 1000 entries. 

Is there any way which I (basic user) can follow to get around this limitation and create succesful query for e.g. 5000 entries using |search?

[dhirendra761]

Put in the last 

|head <no_of_desired_searh_results_>

for example:

<your query>| head 5000