Splunk Search
Highlighted

| metadata type=sources maxes out at 10000 - limits.conf setting?

Path Finder

For some reason this search maxes out at 10000 (i.e. only returns 10000 sources, there are more...), and I can't seem to find the related limit - is it hardcoded?

Tags (2)
Highlighted

Re: | metadata type=sources maxes out at 10000 - limits.conf setting?

Splunk Employee
Splunk Employee

Yes, it is hard coded on 4.0.x. In 3.x, you can add a count=100000 parameter to increase the number of results returned.

View solution in original post

Highlighted

Re: | metadata type=sources maxes out at 10000 - limits.conf setting?

Path Finder

Why is it hard coded? Is there an alternative to count sources that's as quick as using the metadata?

0 Karma
Highlighted

Re: | metadata type=sources maxes out at 10000 - limits.conf setting?

Splunk Employee
Splunk Employee

It is tunable in 4.1.x in limits.conf.

Add to etc/system/local/limits.conf:

[metadata]
maxcount = *some larger number*

View solution in original post