All Apps and Add-ons

Why are search results limited to only 100000 results when there are actually more results?

raghu0463
Explorer

Hi,

When i run a search i was able to see only 100000 results but actually it as like 170000 results. I don't know why its giving less number of results.

0 Karma
1 Solution

cmerriman
Super Champion

what is your search command? chart or timechart? use limit=0 to eliminate the limit.

otherwise, can we see what the search is?

View solution in original post

cmerriman
Super Champion

what is your search command? chart or timechart? use limit=0 to eliminate the limit.

otherwise, can we see what the search is?

raghu0463
Explorer

im running the search in db connect, i didn't use any chart or timechart

0 Karma

cmerriman
Super Champion

try adding maxrows=0 in your dbxquery

my typical dbxquery looks like this:
|dbxquery connection=DB shortnames=t maxrows=0 query="select ....."

horsefez
SplunkTrust
SplunkTrust

go to db-connect app folder under local and edit inputs.conf where you can find the parameter "max_rows" as well

0 Karma

raghu0463
Explorer

thanks, now im getting all the results but unable to load it to the database ..

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...