Splunk Search

Why are search results cut off at 10,000 in Splunk Web and 10,000 or 20,000 results via REST API?

sjodle
Path Finder

When searching a large data set through Splunk Web, results are capped at 10,000 events. When searching through the REST API on the same search head, results are sometimes cut off at 10,000 events and sometimes at 20,000.

How can I retrieve the full results of a search?

1 Solution

woodcock
Esteemed Legend

Are you using sort? It defaults to 10K but you can unlimit it by using sort 0. Many splunk commands limit the output of your results with a silly low-limit default. Backtrack through your commands and find the culprit and unlimit it.

View solution in original post

woodcock
Esteemed Legend

Are you using sort? It defaults to 10K but you can unlimit it by using sort 0. Many splunk commands limit the output of your results with a silly low-limit default. Backtrack through your commands and find the culprit and unlimit it.

sjodle
Path Finder

That was it, thanks. Added "0" between "sort" and my field name, and the limit went away.

0 Karma

sjodle
Path Finder

Even after removing the sort limit, results from the REST API still seem to be capped, this time at 500,000.

0 Karma

woodcock
Esteemed Legend

You should post a new question.

0 Karma

sjodle
Path Finder

OK, will do.

0 Karma

woodcock
Esteemed Legend

I feel your pain.

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

Industry Solutions for Supply Chain and OT, Amazon Use Cases, Plus More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...