Splunk Search

maxresultrows not working for | search ... | stats count

rfujara_splunk
Splunk Employee
Splunk Employee

I'm the developer of the R Project app and currently working on issue #13.

When executing this...

index=_internal | r "output=data.frame(count=nrow(input))"

... it returns a count column with one row containing the number of events that are passed from the search (which is implicitly a search command) to the r command. But it's limited to the maxresultrows setting.

Based on what I see limits.conf documentation, that's the expected behaviour.

However, when executing this...

index=_internal | stats count

.. it returns the actual event count (which is not limited!), to me that's an unexpected behaviour.

Why is the number of search results not limited when passing piping the events to a stats command?

0 Karma
1 Solution

roryab
Splunk Employee
Splunk Employee

The stats command is a streaming command that uses map reduce to return the results of its calculations.

In the case of

index=_internal | stats count

only one actual result is returned - count

The search query may run against millions of actual events, but the events are not returned by the search, just the result.

The maxresults setting limits the number of results returned by the whole search, not the number of events it can scan.

View solution in original post

roryab
Splunk Employee
Splunk Employee

The stats command is a streaming command that uses map reduce to return the results of its calculations.

In the case of

index=_internal | stats count

only one actual result is returned - count

The search query may run against millions of actual events, but the events are not returned by the search, just the result.

The maxresults setting limits the number of results returned by the whole search, not the number of events it can scan.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...