maxresults and stats command

[kbecker]

Does maxresults in limits.conf have an effect when piping results to the stats command? For example, if I run a search over 15 minutes Splunk says there are 523,107 results between 9:00am and 9:15, however only 1000 pages (10 results/page) of results are displayed in the web gui, so 10,000 results, which matches the value in limits.conf. Does the stats command report across all 523,107 results or only the 10,000 that are displayed in the web gui?

Thanks in advance for any help.

[gkanapathy · Accepted solution]

What's the particular command you are running? Yes, the results are accurate over all events for the buckets that are displayed, but only displays up to 10,000 rows.

For example,

* | stats count by id

might only list 10,000 entries, but each count value will be accurate for all events. Furthermore,

* | stats count by id | stats count

will give you the correct number of distinct id's even if it's more than 10,000, and

* | stats count by id | stats sum(count)

will give you the correct total number of events with an id, not just the sum of the first 10,000. (Of course there are other ways to compute these values, but the point is that the limit only affects the total number of final results displayed in the web UI.)

Finally, running

* | stats count by id | outputcsv myoutfile

will write the output file $SPLUNK_HOME/var/run/splunk/myoutfile.csv with the entire set of results, even though only 10,000 are displayed in the web interface.