Splunk Search

incorrect number of events in search results when using sort command

alextsui
Path Finder

Hi. When searching "index=sample | sort host", the search stopped at 10000 events. Is there a limit on number of events returned by the sort command?

Thanks.

Tags (2)
2 Solutions

Ayn
Legend

Yes, there is a default limit of 10000 events for the sort command. However you can specify your own limit as a parameter, so for instance if you want to specify a limit of 15000 events instead you would do this:

index=sample | sort 15000 host

More information regarding the sort command is available here. http://www.splunk.com/base/Documentation/latest/SearchReference/Sort

View solution in original post

sideview
SplunkTrust
SplunkTrust

Yes the sort command will only return 10,000 rows by default. You can raise that by specifying a different limit, ie | sort 50000 host however eventually you may hit other more fundamental limits.

And I think you may want to look at this:

| stats count by host

which will chug through all the work and wont hit any kind of limits.

View solution in original post

sideview
SplunkTrust
SplunkTrust

Yes the sort command will only return 10,000 rows by default. You can raise that by specifying a different limit, ie | sort 50000 host however eventually you may hit other more fundamental limits.

And I think you may want to look at this:

| stats count by host

which will chug through all the work and wont hit any kind of limits.

iKate
Builder

@sideview I'm facing with a similar problem maybe you can take a look and give advice? http://splunk-base.splunk.com/answers/62296/wrong-sorting

0 Karma

Ayn
Legend

Yes, there is a default limit of 10000 events for the sort command. However you can specify your own limit as a parameter, so for instance if you want to specify a limit of 15000 events instead you would do this:

index=sample | sort 15000 host

More information regarding the sort command is available here. http://www.splunk.com/base/Documentation/latest/SearchReference/Sort

Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...