Splunk Search

incorrect number of events in search results when using sort command

alextsui
Path Finder

Hi. When searching "index=sample | sort host", the search stopped at 10000 events. Is there a limit on number of events returned by the sort command?

Thanks.

Tags (2)
2 Solutions

Ayn
Legend

Yes, there is a default limit of 10000 events for the sort command. However you can specify your own limit as a parameter, so for instance if you want to specify a limit of 15000 events instead you would do this:

index=sample | sort 15000 host

More information regarding the sort command is available here. http://www.splunk.com/base/Documentation/latest/SearchReference/Sort

View solution in original post

sideview
SplunkTrust
SplunkTrust

Yes the sort command will only return 10,000 rows by default. You can raise that by specifying a different limit, ie | sort 50000 host however eventually you may hit other more fundamental limits.

And I think you may want to look at this:

| stats count by host

which will chug through all the work and wont hit any kind of limits.

View solution in original post

sideview
SplunkTrust
SplunkTrust

Yes the sort command will only return 10,000 rows by default. You can raise that by specifying a different limit, ie | sort 50000 host however eventually you may hit other more fundamental limits.

And I think you may want to look at this:

| stats count by host

which will chug through all the work and wont hit any kind of limits.

iKate
Builder

@sideview I'm facing with a similar problem maybe you can take a look and give advice? http://splunk-base.splunk.com/answers/62296/wrong-sorting

0 Karma

Ayn
Legend

Yes, there is a default limit of 10000 events for the sort command. However you can specify your own limit as a parameter, so for instance if you want to specify a limit of 15000 events instead you would do this:

index=sample | sort 15000 host

More information regarding the sort command is available here. http://www.splunk.com/base/Documentation/latest/SearchReference/Sort

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...