Splunk Search

Why are search results cut off at 10,000 in Splunk Web and 10,000 or 20,000 results via REST API?

sjodle
Path Finder

When searching a large data set through Splunk Web, results are capped at 10,000 events. When searching through the REST API on the same search head, results are sometimes cut off at 10,000 events and sometimes at 20,000.

How can I retrieve the full results of a search?

1 Solution

woodcock
Esteemed Legend

Are you using sort? It defaults to 10K but you can unlimit it by using sort 0. Many splunk commands limit the output of your results with a silly low-limit default. Backtrack through your commands and find the culprit and unlimit it.

View solution in original post

woodcock
Esteemed Legend

Are you using sort? It defaults to 10K but you can unlimit it by using sort 0. Many splunk commands limit the output of your results with a silly low-limit default. Backtrack through your commands and find the culprit and unlimit it.

View solution in original post

sjodle
Path Finder

That was it, thanks. Added "0" between "sort" and my field name, and the limit went away.

0 Karma

sjodle
Path Finder

Even after removing the sort limit, results from the REST API still seem to be capped, this time at 500,000.

0 Karma

woodcock
Esteemed Legend

You should post a new question.

0 Karma

sjodle
Path Finder

OK, will do.

0 Karma

woodcock
Esteemed Legend

I feel your pain.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!