Splunk Search

Subsearch produced 65000000 results, trunacting to maxout 50000

yko84109
Loves-to-Learn

I have the following query:
|tstats values(field1) as f1 values(field2) as f2 where index=INDEX1 [|tstats count where index=INDEX2 by field3 | table field3 | rename field3 as f3] by f3 | sort -fX

What I execute the query above I got the following:
Subsearch produced 65000000 results, trunacting to maxout 50000

What can I do to solve it?

Tags (1)
0 Karma

jkat54
SplunkTrust
SplunkTrust

What are you trying to do with this search?

0 Karma

ddrillic
Ultra Champion

@yko84109, please follow the instructions given by @inventsekar at Subsearch produced 50000 results, truncating to maxout 50000

0 Karma
Get Updates on the Splunk Community!

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...

UCC Framework: Discover Developer Toolkit for Building Technology Add-ons

The Next-Gen Toolkit for Splunk Technology Add-on Development The Universal Configuration Console (UCC) ...

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...