I have a search in which I am sorting my data based on "Location" field:
my search | sort Location + desc
My result is having 13,000 lines but I am getting only 10,000 lines as my result along with some msg:
sort is trucating only 10,000 rows
Could you please let me know how to solve this "sort" problem so that it should take all the lines in my result
Please help
Thanks in Advance
That is no error. A quick look in the docs entry for the sort
command (http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/sort ) would have given you this:
sort [<count>] (<sort-by-clause>)+ [desc]
...
<count>
Syntax: <int>
Description: Specify the number of results to sort. If no count is specified, the default limit of 10000 is used. If "0" is specified, all results will be returned.
That is no error. A quick look in the docs entry for the sort
command (http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/sort ) would have given you this:
sort [<count>] (<sort-by-clause>)+ [desc]
...
<count>
Syntax: <int>
Description: Specify the number of results to sort. If no count is specified, the default limit of 10000 is used. If "0" is specified, all results will be returned.