All Apps and Add-ons

Why are search results limited to only 100000 results when there are actually more results?

raghu0463
Explorer

Hi,

When i run a search i was able to see only 100000 results but actually it as like 170000 results. I don't know why its giving less number of results.

0 Karma
1 Solution

cmerriman
Super Champion

what is your search command? chart or timechart? use limit=0 to eliminate the limit.

otherwise, can we see what the search is?

View solution in original post

cmerriman
Super Champion

what is your search command? chart or timechart? use limit=0 to eliminate the limit.

otherwise, can we see what the search is?

raghu0463
Explorer

im running the search in db connect, i didn't use any chart or timechart

0 Karma

cmerriman
Super Champion

try adding maxrows=0 in your dbxquery

my typical dbxquery looks like this:
|dbxquery connection=DB shortnames=t maxrows=0 query="select ....."

horsefez
Motivator

go to db-connect app folder under local and edit inputs.conf where you can find the parameter "max_rows" as well

0 Karma

raghu0463
Explorer

thanks, now im getting all the results but unable to load it to the database ..

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...