All Apps and Add-ons

Why are search results limited to only 100000 results when there are actually more results?

raghu0463
Explorer

Hi,

When i run a search i was able to see only 100000 results but actually it as like 170000 results. I don't know why its giving less number of results.

0 Karma
1 Solution

cmerriman
Super Champion

what is your search command? chart or timechart? use limit=0 to eliminate the limit.

otherwise, can we see what the search is?

View solution in original post

cmerriman
Super Champion

what is your search command? chart or timechart? use limit=0 to eliminate the limit.

otherwise, can we see what the search is?

raghu0463
Explorer

im running the search in db connect, i didn't use any chart or timechart

0 Karma

cmerriman
Super Champion

try adding maxrows=0 in your dbxquery

my typical dbxquery looks like this:
|dbxquery connection=DB shortnames=t maxrows=0 query="select ....."

horsefez
SplunkTrust
SplunkTrust

go to db-connect app folder under local and edit inputs.conf where you can find the parameter "max_rows" as well

0 Karma

raghu0463
Explorer

thanks, now im getting all the results but unable to load it to the database ..

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...