Reporting

loadjob returns only 100 of 150 events

igschloessl
Explorer

I have a search which returns 150 Events but when I use the loadjob command I can only work with 100 Events of the original search.
Can I configure this anywhere in the splunk settings? Because it makes less sense to search through just a part of the Events.
Does anyone know how to fix this?

Thx in advance.

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Where are you getting the numbers 150 and 100? Did you look at the original search and export it to csv to see how many results you really got, or are you relying on the "nnn" events display on the search screen?

Here's one possibility - the verb sort will limit the output to 100 results unless you specifically tell it otherwise by specifying | sort 0. If you have a sort in your initial search, or in the search with the loadjob, then that is your problem.

Other ways you can get exactly 100 is if you do a stats with the values aggregate function. That has a limit of 100 as well.

If that is not the problem, then the limit should have been either 10K or 50K, so those are your most likely culprits.

0 Karma

cmerriman
Super Champion

what does your loadjob look like? i just did a quick test in my local instance with index=_internal earliest=-4h|head=150 and then |loadjob 1533311493.102 events=true and i got 150 events back. i also tried another search with a table that had 150 rows and the loadjob without events=true. there shouldn't be a difference if using a saved search, i wouldn't think.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...