Splunk Search
Highlighted

incorrect number of events in search results when using sort command

Path Finder

Hi. When searching "index=sample | sort host", the search stopped at 10000 events. Is there a limit on number of events returned by the sort command?

Thanks.

Tags (2)
Highlighted

Re: incorrect number of events in search results when using sort command

Legend

Yes, there is a default limit of 10000 events for the sort command. However you can specify your own limit as a parameter, so for instance if you want to specify a limit of 15000 events instead you would do this:

index=sample | sort 15000 host

More information regarding the sort command is available here. http://www.splunk.com/base/Documentation/latest/SearchReference/Sort

View solution in original post

Highlighted

Re: incorrect number of events in search results when using sort command

SplunkTrust
SplunkTrust

Yes the sort command will only return 10,000 rows by default. You can raise that by specifying a different limit, ie | sort 50000 host however eventually you may hit other more fundamental limits.

And I think you may want to look at this:

| stats count by host

which will chug through all the work and wont hit any kind of limits.

View solution in original post

Highlighted

Re: incorrect number of events in search results when using sort command

Builder

@sideview I'm facing with a similar problem maybe you can take a look and give advice? http://splunk-base.splunk.com/answers/62296/wrong-sorting

0 Karma