Splunk Search

maxresultrows not working for | search ... | stats count

rfujara_splunk
Splunk Employee
Splunk Employee

I'm the developer of the R Project app and currently working on issue #13.

When executing this...

index=_internal | r "output=data.frame(count=nrow(input))"

... it returns a count column with one row containing the number of events that are passed from the search (which is implicitly a search command) to the r command. But it's limited to the maxresultrows setting.

Based on what I see limits.conf documentation, that's the expected behaviour.

However, when executing this...

index=_internal | stats count

.. it returns the actual event count (which is not limited!), to me that's an unexpected behaviour.

Why is the number of search results not limited when passing piping the events to a stats command?

0 Karma
1 Solution

roryab
Splunk Employee
Splunk Employee

The stats command is a streaming command that uses map reduce to return the results of its calculations.

In the case of

index=_internal | stats count

only one actual result is returned - count

The search query may run against millions of actual events, but the events are not returned by the search, just the result.

The maxresults setting limits the number of results returned by the whole search, not the number of events it can scan.

View solution in original post

roryab
Splunk Employee
Splunk Employee

The stats command is a streaming command that uses map reduce to return the results of its calculations.

In the case of

index=_internal | stats count

only one actual result is returned - count

The search query may run against millions of actual events, but the events are not returned by the search, just the result.

The maxresults setting limits the number of results returned by the whole search, not the number of events it can scan.

*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>