incorrect number of events in search results when using sort command

[alextsui]

Hi. When searching "index=sample | sort host", the search stopped at 10000 events. Is there a limit on number of events returned by the sort command?

Thanks.

[Ayn · Accepted solution]

Yes, there is a default limit of 10000 events for the sort command. However you can specify your own limit as a parameter, so for instance if you want to specify a limit of 15000 events instead you would do this:

index=sample | sort 15000 host

More information regarding the sort command is available here. http://www.splunk.com/base/Documentation/latest/SearchReference/Sort

[sideview · Accepted solution]

Yes the sort command will only return 10,000 rows by default. You can raise that by specifying a different limit, ie | sort 50000 host however eventually you may hit other more fundamental limits.

And I think you may want to look at this:

| stats count by host

which will chug through all the work and wont hit any kind of limits.

[iKate]

@sideview I'm facing with a similar problem maybe you can take a look and give advice? http://splunk-base.splunk.com/answers/62296/wrong-sorting

[Ayn · Accepted solution]

Yes, there is a default limit of 10000 events for the sort command. However you can specify your own limit as a parameter, so for instance if you want to specify a limit of 15000 events instead you would do this:

index=sample | sort 15000 host

More information regarding the sort command is available here. http://www.splunk.com/base/Documentation/latest/SearchReference/Sort