Splunk Search

splunk query drops off results after query has finished

imosquera
Explorer

I had a query that was working perfectly until recently where it started cutting off the last 4 days of data just for one grouping for the "Live" category. The odd thing is it only disapeers the results right before the query has completed otherwise it computes the results almost all the way to the end.

as query begins:
http://cl.ly/image/3a27251m0C0w

right before completion:
http://cl.ly/image/2j3b360c3C3u

here is the query:
* search_name="EXEC: New Users By Label (daily) (summary index)" index="summary" | stats count(value_user_device_udid) as new_users by _time, label | streamstats sum(new_users) as total_users by _time,label | eval live=if(total_users >= 100, "Live", "Pending") | stats values(label) as label_values count as daily_count by _time, live | streamstats dc(label_values) as total_apps by live.

I've doubled the limits for the following in limits.conf:

[searchresults]
maxresultrows = 100000

max_stream_window = 30000

[stats]
maxresultrows = 100000

Tags (2)
0 Karma
1 Solution

imosquera
Explorer

Turns out I didn't actually save my limits.conf when I changed the following config:

[stats]
maxresultrows = 100000

turns out doubling the stats resultrows worked and now I get all my entire results set.

View solution in original post

0 Karma

imosquera
Explorer

Turns out I didn't actually save my limits.conf when I changed the following config:

[stats]
maxresultrows = 100000

turns out doubling the stats resultrows worked and now I get all my entire results set.

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...