What is the effect of maxresultrows for [stats] in limits.conf?

[melonman]

Hi,

My understanding about the configuration parameter "maxresultrows" for [stats] is for limiting the number of stats result up to 50,000 by default.

limits.conf.spec

[stats|sistats]
maxresultrows = <integer>
* Maximum number of result rows to create.
* If not specified, defaults to searchresults::maxresultrows (which is by default 50000).

However, when I run a search, "... | stats count by ipaddress", the result actually exceed far more than 50,000.
Is this maxresultrows for stats table row count or other purpose?

I thought I would see some warning or error message with stats results with more than 50,000.
e.g. stats count by ipaddress, where unique ipaddresses are more than 50,000.

Any comment regarding this parameter is appreciated.
Thank you in advance.

[cwl · Accepted solution]

maxresultrows for stats * does not * restrict the number of rows in the result. However, it determines the number of rows present in the memory. If the result size goes over > the maxres and if our memusage > max_mem_usage then splunk save it to disk. 6.0.5 docs mentioned about it.

http://docs.splunk.com/Documentation/Splunk/6.0.5/Admin/Limitsconf
maxresultrows =
* Maximum number of rows allowed in the process memory.
* When the search process exceeds max_mem_usage_mb and maxresultrows, data is spilled out to the disk
* If not specified, defaults to searchresults::maxresultrows (which is by default 50000).

[Splunk_Shinobi]

That is controlling the timing to swap the partial calculation to the disk. it is not limiting the max number of actual rows to be returned.

"When the search process exceeds max_mem_usage_mb and maxresultrows, data is spilled out to the disk"