Splunk Search

HiddenPostProcess 10000 search results limit

Parameshwara
Path Finder

In my advanced XML, an accelerated saved search is initially run that provides results without any limitations in terms of number of results. I've then introduced a HiddenPostProcess sub module which categorises the results into type of messages (error, warning, etc.).

Example:
 1. My accelerated saved search shows there are 100 events for a period
 2. My HiddenPostProcess sub module shows that in the 100 events, there are 60 error messages, 30 warning messages, and 10 alert messages.

Problem:
 1. My accelerated saved search shows there are 11000 events for a period
 2. My HiddenPostProcess sub module shows only details of the first 10000 events (i.e. there are 9000 error messages, 500 warning messages, and 500 alert messages.)

I have tried setting various limits in limits.conf but have not worked. How do i fix this 10000 result limit?

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi Parameshwara

here is an extract from docs about HiddenPostProcess:

  A post process search has an unconfigurable limit of 10,000 raw events that can be passed to it.

You could avoid the limit by using smaller time ranges to construct the data cube before passing them on to the HiddenPostProcess.

Hope this helps.....

Cheers, MuS

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...