Splunk Search

maxresults and stats command

kbecker
Communicator

Does maxresults in limits.conf have an effect when piping results to the stats command? For example, if I run a search over 15 minutes Splunk says there are 523,107 results between 9:00am and 9:15, however only 1000 pages (10 results/page) of results are displayed in the web gui, so 10,000 results, which matches the value in limits.conf. Does the stats command report across all 523,107 results or only the 10,000 that are displayed in the web gui?

Thanks in advance for any help.

Tags (2)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

What's the particular command you are running? Yes, the results are accurate over all events for the buckets that are displayed, but only displays up to 10,000 rows.

For example,

* | stats count by id

might only list 10,000 entries, but each count value will be accurate for all events. Furthermore,

* | stats count by id | stats count

will give you the correct number of distinct id's even if it's more than 10,000, and

* | stats count by id | stats sum(count)

will give you the correct total number of events with an id, not just the sum of the first 10,000. (Of course there are other ways to compute these values, but the point is that the limit only affects the total number of final results displayed in the web UI.)

Finally, running

* | stats count by id | outputcsv myoutfile

will write the output file $SPLUNK_HOME/var/run/splunk/myoutfile.csv with the entire set of results, even though only 10,000 are displayed in the web interface.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

What's the particular command you are running? Yes, the results are accurate over all events for the buckets that are displayed, but only displays up to 10,000 rows.

For example,

* | stats count by id

might only list 10,000 entries, but each count value will be accurate for all events. Furthermore,

* | stats count by id | stats count

will give you the correct number of distinct id's even if it's more than 10,000, and

* | stats count by id | stats sum(count)

will give you the correct total number of events with an id, not just the sum of the first 10,000. (Of course there are other ways to compute these values, but the point is that the limit only affects the total number of final results displayed in the web UI.)

Finally, running

* | stats count by id | outputcsv myoutfile

will write the output file $SPLUNK_HOME/var/run/splunk/myoutfile.csv with the entire set of results, even though only 10,000 are displayed in the web interface.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...