Top Limit 50000 results - Where to Change?

[aferone]

In my local limits.conf file, on my Search Head, I have the following:

[searchresults]

maxresultrows = 100000

[stats]

maxresultrows = 100000

However, I still get this error message:

"Error in 'top' command: The limit must be <= 50000."

Am I making the correct changes, and should they be on the Search Head or my Indexer?

Thanks!

[aferone]

Thank you!

[somesoni2]

I see following text in the limits.conf documentation.
http://docs.splunk.com/Documentation/Splunk/6.1.1/admin/Limitsconf

*****limits.conf settings and DISTRIBUTED SEARCH
Unlike most settings which affect searches, limits.conf settings are not provided by the search head to be used by the search peers. This means that if you need to alter search-affecting limits in a distributed environment, typically you will need to modify these settings on the relevant peers and search head for consistent results.

[aferone · Accepted solution]

I added this to my limits.conf on the INDEXER, and it is now working.

[searchresults]

maxresultrows = 100000

[stats]

maxresultrows = 100000

[top]

maxresultrows = 100000

[aferone]

Thank you, but there is no reference to whether this should be on the indexer or search head.

[somesoni2]

Try answer from this

http://answers.splunk.com/answers/77543/search-command-top-does-not-return-more-than-100k-results