mvexpand limited results to 10000 events

[alextsui]

Hi, I needed to use mvexpand in my search(see below), but it limited my search results to 10000 events. Is there a way to increase or diable the limitation?

earliest="@d" splunk_server="Splunk4-02" index="rnc" sourcetype="RNC" managedObject_class="WCEL" "HSDPALayeringCommonChEnabled" OR "HSUPAEnabled" | stats values(HSDPALayeringCommonChEnabled) as HSDPALayeringCommonChEnabled, values(HSUPAEnabled) as HSUPAEnabled, values(distName) as distName by host | mvexpand distName

[bbingham]

Incase you want to take a look at the limits, they are established on $SPLUNK_HOME/etc/system/default/limits.conf, find the one you'd like to change, create a new limits.conf and place under $SPLUNK_HOME/etc/system/local/limits.conf

[bwooden]

Can you get the results you want with this search:

earliest="@d" splunk_server="Splunk4-02" index="rnc" sourcetype="RNC" managedObject_class="WCEL" "HSDPALayeringCommonChEnabled" OR "HSUPAEnabled" | stats values(HSDPALayeringCommonChEnabled) as HSDPALayeringCommonChEnabled, values(HSUPAEnabled) as HSUPAEnabled, by distName host