Splunk Search

append and max results (50000)

johnnymc
Path Finder

i'm trying to merge results from two searches to join various values from the search field.

i see that the latter search is stuck at 50000 results, whatever or not i append maxout=500000 and maxtime=86400 .

earliest="-w@w+1d" latest="-d@w-1d"  foo | append maxtime=14400 maxout=5000000 [search earliest="-w@w+1d" bar ].

i'm still getting 50000 results only from the bar search.
any clues?
i'd prefer not to modify conf files.

thanks

yannK
Splunk Employee
Splunk Employee

For the append command, you have 2 setting that controls the limit.

You can use maxout to reduce the number of results to append but not to go above the maxresultrows limit.


[searchresults] maxresultrows = 50000
and
index=* | head 100 | append maxout=10000 [ search index=* ]
will return 10100 events

[searchresults] maxresultrows = 50000
and
index=* | head 100 | append maxout=100000000000 [ search index=* ]
will return only 50100 events.

bbingham
Builder

I think you're hitting the hard limit in limits.conf for a join. I don't think there is a way around this without modifying the conf files.

[join]
subsearch_maxout = 50000
subsearch_maxtime = 60
subsearch_timeout = 120

johnnymc
Path Finder

nope. modfying join doesn't work.
it seems it has something to do with:

[searchresults]
* This stanza controls search results for a variety of Splunk search commands.

maxresultrows = <integer>
Get Updates on the Splunk Community!

Bridging the Gap: Splunk Helps Students Move from Classroom to Career

The Splunk Community is a powerful network of users, educators, and organizations working together to tackle ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureThursday, March 27, 2025  |  11AM PST / 2PM EST | Register NowStep boldly ...