Why are search results cut off at 10,000 in Splunk Web and 10,000 or 20,000 results via REST API?

[sjodle]

When searching a large data set through Splunk Web, results are capped at 10,000 events. When searching through the REST API on the same search head, results are sometimes cut off at 10,000 events and sometimes at 20,000.

How can I retrieve the full results of a search?

[woodcock · Accepted solution]

Are you using sort? It defaults to 10K but you can unlimit it by using sort 0. Many splunk commands limit the output of your results with a silly low-limit default. Backtrack through your commands and find the culprit and unlimit it.

[sjodle]

That was it, thanks. Added "0" between "sort" and my field name, and the limit went away.

[sjodle]

Even after removing the sort limit, results from the REST API still seem to be capped, this time at 500,000.

[woodcock]

You should post a new question.

[sjodle]

OK, will do.

[woodcock]

I feel your pain.