Splunk Search

append and max results (50000)

johnnymc
Path Finder

i'm trying to merge results from two searches to join various values from the search field.

i see that the latter search is stuck at 50000 results, whatever or not i append maxout=500000 and maxtime=86400 .

earliest="-w@w+1d" latest="-d@w-1d"  foo | append maxtime=14400 maxout=5000000 [search earliest="-w@w+1d" bar ].

i'm still getting 50000 results only from the bar search.
any clues?
i'd prefer not to modify conf files.

thanks

yannK
Splunk Employee
Splunk Employee

For the append command, you have 2 setting that controls the limit.

You can use maxout to reduce the number of results to append but not to go above the maxresultrows limit.


[searchresults] maxresultrows = 50000
and
index=* | head 100 | append maxout=10000 [ search index=* ]
will return 10100 events

[searchresults] maxresultrows = 50000
and
index=* | head 100 | append maxout=100000000000 [ search index=* ]
will return only 50100 events.

bbingham
Builder

I think you're hitting the hard limit in limits.conf for a join. I don't think there is a way around this without modifying the conf files.

[join]
subsearch_maxout = 50000
subsearch_maxtime = 60
subsearch_timeout = 120

johnnymc
Path Finder

nope. modfying join doesn't work.
it seems it has something to do with:

[searchresults]
* This stanza controls search results for a variety of Splunk search commands.

maxresultrows = <integer>
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...