Splunk Search

append and max results (50000)

johnnymc
Path Finder

i'm trying to merge results from two searches to join various values from the search field.

i see that the latter search is stuck at 50000 results, whatever or not i append maxout=500000 and maxtime=86400 .

earliest="-w@w+1d" latest="-d@w-1d"  foo | append maxtime=14400 maxout=5000000 [search earliest="-w@w+1d" bar ].

i'm still getting 50000 results only from the bar search.
any clues?
i'd prefer not to modify conf files.

thanks

yannK
Splunk Employee
Splunk Employee

For the append command, you have 2 setting that controls the limit.

You can use maxout to reduce the number of results to append but not to go above the maxresultrows limit.


[searchresults] maxresultrows = 50000
and
index=* | head 100 | append maxout=10000 [ search index=* ]
will return 10100 events

[searchresults] maxresultrows = 50000
and
index=* | head 100 | append maxout=100000000000 [ search index=* ]
will return only 50100 events.

bbingham
Builder

I think you're hitting the hard limit in limits.conf for a join. I don't think there is a way around this without modifying the conf files.

[join]
subsearch_maxout = 50000
subsearch_maxtime = 60
subsearch_timeout = 120

johnnymc
Path Finder

nope. modfying join doesn't work.
it seems it has something to do with:

[searchresults]
* This stanza controls search results for a variety of Splunk search commands.

maxresultrows = <integer>
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...