Splunk Search

'stats' command: limit for values of field 'xxx' reached. Some values may have been truncated or ignored.

jamesvz84
Communicator

Hello,

I am using the stats command with the list() function. Unfortunately, for some groupings the list size exceeds Splunk's limit. Is there a setting in limits.conf or anywhere else where I can increase this limit? Using values() instead of list() will not work for me, as I need to keep the sequence of events, as well as duplicate values.

Error message:
'stats' command: limit for values of field 'xxx' reached. Some values may have been truncated or ignored.

Tags (4)

hwakonwalk
Path Finder

I was able to resolve the issue by adding the following to limits.conf
[stats]
list_maxsize = 10000
maxresultrows = 50000
maxvalues = 10000
maxvaluesize = 10000

nawazns5038
Builder

try using table and dedup together

0 Karma

landen99
Motivator

values allows the list to be much longer but it also removes duplicate field values and sorts the field values.

0 Karma

dkuk
Path Finder

This limits.conf might help you:

list_maxsize = <int>
 * Maximum number of list items to emit when using the list() function stats/sistats
 * Defaults to 100

hwakonwalk
Path Finder

Does it resolve the problem, I face the same issue

0 Karma

ktn01
Path Finder

Do you put it on the right stanza?

[stats]
list_maxsize = 300

[sistats]
list_maxsize = 300

0 Karma

nikkkc
Path Finder

i tried this, but this does not work!

0 Karma

adauria_splunk
Splunk Employee
Splunk Employee

note that this must be under a [stats] and/or [sistats] stanza within a limits.conf in order to work right!

martin_mueller
SplunkTrust
SplunkTrust

What's your use case? Maybe there's a way to go without list().

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...