Splunk Enterprise

Results Limiting to 50,000: How to tweak my query to see complete results without restricting?

vishwa
Path Finder

I have below query:


 index=demo-app  TERM(Application) TERM(Received) NOR TERM(processed)
|stats count by ApplicationId
|fields ApplicationId
|eval matchfield=ApplicationId
|join matchfield [search index=demo-app  TERM(App) TERM(transaction)
|stats count by MessageCode
|fields MessageCode
|eval matchfield =MessageCode]

|stats count(matchfield)

When i run this search query the statics values are  limiting to 50,000
How to tweak my query to see complete results without restricting.

 

Labels (1)
Tags (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

You're using the join command which spawns a subsearch. Subsearches have a limit on runtime as well as on returned results. You're hitting that limit. Try reworking your search so that you don't need to use join. It's often better to group your data with the stats command especially that both searches you're trying to join are from the same index.

As a side note, with a raw search, I don't think there will be a noticeable difference between TERM(Application) and just searching for the string Application - there would be a huge difference though if you reworked your search | stats into a tstats-based search.

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

You're using the join command which spawns a subsearch. Subsearches have a limit on runtime as well as on returned results. You're hitting that limit. Try reworking your search so that you don't need to use join. It's often better to group your data with the stats command especially that both searches you're trying to join are from the same index.

As a side note, with a raw search, I don't think there will be a noticeable difference between TERM(Application) and just searching for the string Application - there would be a huge difference though if you reworked your search | stats into a tstats-based search.

Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...