Splunk Search

Why are search results cut off at 10,000 in Splunk Web and 10,000 or 20,000 results via REST API?

sjodle
Path Finder

When searching a large data set through Splunk Web, results are capped at 10,000 events. When searching through the REST API on the same search head, results are sometimes cut off at 10,000 events and sometimes at 20,000.

How can I retrieve the full results of a search?

1 Solution

woodcock
Esteemed Legend

Are you using sort? It defaults to 10K but you can unlimit it by using sort 0. Many splunk commands limit the output of your results with a silly low-limit default. Backtrack through your commands and find the culprit and unlimit it.

View solution in original post

woodcock
Esteemed Legend

Are you using sort? It defaults to 10K but you can unlimit it by using sort 0. Many splunk commands limit the output of your results with a silly low-limit default. Backtrack through your commands and find the culprit and unlimit it.

sjodle
Path Finder

That was it, thanks. Added "0" between "sort" and my field name, and the limit went away.

0 Karma

sjodle
Path Finder

Even after removing the sort limit, results from the REST API still seem to be capped, this time at 500,000.

0 Karma

woodcock
Esteemed Legend

You should post a new question.

0 Karma

sjodle
Path Finder

OK, will do.

0 Karma

woodcock
Esteemed Legend

I feel your pain.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...