Splunk Search

Error in "sort" command

abhayneilam
Contributor

I have a search in which I am sorting my data based on "Location" field:

my search | sort Location + desc

My result is having 13,000 lines but I am getting only 10,000 lines as my result along with some msg:

sort is trucating only 10,000 rows

Could you please let me know how to solve this "sort" problem so that it should take all the lines in my result

Please help

Thanks in Advance

Tags (4)
0 Karma
1 Solution

Ayn
Legend

That is no error. A quick look in the docs entry for the sort command (http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/sort ) would have given you this:

sort [<count>] (<sort-by-clause>)+ [desc] 

...

<count>
Syntax: <int> 
Description: Specify the number of results to sort. If no count is specified, the default limit of 10000 is used. If "0" is specified, all results will be returned. 

View solution in original post

Ayn
Legend

That is no error. A quick look in the docs entry for the sort command (http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/sort ) would have given you this:

sort [<count>] (<sort-by-clause>)+ [desc] 

...

<count>
Syntax: <int> 
Description: Specify the number of results to sort. If no count is specified, the default limit of 10000 is used. If "0" is specified, all results will be returned. 
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...