I am writing a search where I am subtracting values of 2 fields and inserting into a new field using the eval command. The result always contains up to 10,000 records, even though there are more events for the search. Can some one help me understand why is it so and is there any way to change that?
When I try the same search without the eval command, it returns the actual number of events for the search.
Need urgent help with the question. Any help would be highly appreciated. Thanks!
Can you post your search? There has to be something else in that search causing this, a subsearch for example.
Here's my search query -
index=*txn* prefetch.go | rex "eprov_rcae3=[\d]+:(?\d*)" | rex "findNgenOMOffers=[\d]+:(?\d*)" | eval Difference=OMResponseTime-RCAEResponseTime | sort -Difference | table GSID, RCAEResponseTime, OMResponseTime, Difference
The issue is not the
eval command but rather the sort that is imposing a 10,000 result limit. If instead of:
... | sort - Difference | ...
... | sort 0 - Difference | ...
All results should be returned. (At the cost of more resource usage during the search of course).