Splunk Search

'stats' command: limit for values of field 'xxx' reached. Some values may have been truncated or ignored.

jamesvz84
Communicator

Hello,

I am using the stats command with the list() function. Unfortunately, for some groupings the list size exceeds Splunk's limit. Is there a setting in limits.conf or anywhere else where I can increase this limit? Using values() instead of list() will not work for me, as I need to keep the sequence of events, as well as duplicate values.

Error message:
'stats' command: limit for values of field 'xxx' reached. Some values may have been truncated or ignored.

Tags (4)

hwakonwalk
Path Finder

I was able to resolve the issue by adding the following to limits.conf
[stats]
list_maxsize = 10000
maxresultrows = 50000
maxvalues = 10000
maxvaluesize = 10000

nawazns5038
Builder

try using table and dedup together

0 Karma

landen99
Motivator

values allows the list to be much longer but it also removes duplicate field values and sorts the field values.

0 Karma

dkuk
Path Finder

This limits.conf might help you:

list_maxsize = <int>
 * Maximum number of list items to emit when using the list() function stats/sistats
 * Defaults to 100

hwakonwalk
Path Finder

Does it resolve the problem, I face the same issue

0 Karma

ktn01
Path Finder

Do you put it on the right stanza?

[stats]
list_maxsize = 300

[sistats]
list_maxsize = 300

0 Karma

nikkkc
Path Finder

i tried this, but this does not work!

0 Karma

adauria_splunk
Splunk Employee
Splunk Employee

note that this must be under a [stats] and/or [sistats] stanza within a limits.conf in order to work right!

martin_mueller
SplunkTrust
SplunkTrust

What's your use case? Maybe there's a way to go without list().

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!