Splunk Enterprise

Results Limiting to 50,000: How to tweak my query to see complete results without restricting?

vishwa
Path Finder

I have below query:


 index=demo-app  TERM(Application) TERM(Received) NOR TERM(processed)
|stats count by ApplicationId
|fields ApplicationId
|eval matchfield=ApplicationId
|join matchfield [search index=demo-app  TERM(App) TERM(transaction)
|stats count by MessageCode
|fields MessageCode
|eval matchfield =MessageCode]

|stats count(matchfield)

When i run this search query the statics values are  limiting to 50,000
How to tweak my query to see complete results without restricting.

 

Labels (1)
Tags (1)
0 Karma
1 Solution

PickleRick
Ultra Champion

You're using the join command which spawns a subsearch. Subsearches have a limit on runtime as well as on returned results. You're hitting that limit. Try reworking your search so that you don't need to use join. It's often better to group your data with the stats command especially that both searches you're trying to join are from the same index.

As a side note, with a raw search, I don't think there will be a noticeable difference between TERM(Application) and just searching for the string Application - there would be a huge difference though if you reworked your search | stats into a tstats-based search.

View solution in original post

PickleRick
Ultra Champion

You're using the join command which spawns a subsearch. Subsearches have a limit on runtime as well as on returned results. You're hitting that limit. Try reworking your search so that you don't need to use join. It's often better to group your data with the stats command especially that both searches you're trying to join are from the same index.

As a side note, with a raw search, I don't think there will be a noticeable difference between TERM(Application) and just searching for the string Application - there would be a huge difference though if you reworked your search | stats into a tstats-based search.

Get Updates on the Splunk Community!

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? 🚀 We invite you to join our elite squad ...