Splunk Search

mvexpand limited results to 10000 events

alextsui
Path Finder

Hi, I needed to use mvexpand in my search(see below), but it limited my search results to 10000 events. Is there a way to increase or diable the limitation?

earliest="@d" splunk_server="Splunk4-02" index="rnc" sourcetype="RNC" managedObject_class="WCEL" "HSDPALayeringCommonChEnabled" OR "HSUPAEnabled" | stats values(HSDPALayeringCommonChEnabled) as HSDPALayeringCommonChEnabled, values(HSUPAEnabled) as HSUPAEnabled, values(distName) as distName by host | mvexpand distName

Tags (1)
0 Karma

bbingham
Builder

Incase you want to take a look at the limits, they are established on $SPLUNK_HOME/etc/system/default/limits.conf, find the one you'd like to change, create a new limits.conf and place under $SPLUNK_HOME/etc/system/local/limits.conf

0 Karma

bwooden
Splunk Employee
Splunk Employee

Can you get the results you want with this search:

earliest="@d" splunk_server="Splunk4-02" index="rnc" sourcetype="RNC" managedObject_class="WCEL" "HSDPALayeringCommonChEnabled" OR "HSUPAEnabled" | stats values(HSDPALayeringCommonChEnabled) as HSDPALayeringCommonChEnabled, values(HSUPAEnabled) as HSUPAEnabled, by distName host

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...