Splunk Search

Limited rows returned Splunk CLI for a table

EricLloyd79
Builder

First, yes, we are using "-maxout 0"
For some reason, on one of our hosts, when we run a particular query that pipes into a table, it only returns around ~3000 rows depending on the 24 hour period we are searching for.
Here are some of the unusual things we've noticed:
(1) Its not a resource issue. We have upgraded the host to 32 GB memory and 12 cores.
(2) If we run the query and just have it return raw events, it works as expected.
(3) The query works on another host in our cluster as expected so query is good.
(4) If we run for a window that is 3 hours or LESS it will return the number of rows as expected. 4 hours or more and it returns only around 3000 rows.
(5) I did notice that around 3 hours, it returns just under 1 million rows. Im wondering if there is a 1 million rows limit for tables in the CLI.
(6) This runs as expected in the Splunk web GUI.

Any ideas?

0 Karma

EricLloyd79
Builder

As a side note, when I print results as a table, it gets to about 431207 then halts for a second and then starts over at 1 and goes to about 3000.

ex:

431200 20190306 abc 5551212
431201 20190306 abc 5551212
431202 20190306 abc 5551212
431203 20190306 abc 5551212
431204 20190306 abc 5551212
431205 20190306 abc 5551212
431206 20190306 abc 5551212
431207 20190306 abc 5551212
row date fullItemID mdn


1 20190306 abc 5551212
2 20190306 abc 5551212
3 20190306 abc 5551212
4 20190306 abc 5551212
5 20190306 abc 5551212
...

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Can you share the query?

---
If this reply helps you, Karma would be appreciated.
0 Karma

EricLloyd79
Builder

Sure.

/opt/splunk/bin/splunk search 'sourcetype=xyz url=/foo/bar.jsp kpi01 earliest="03/06/2019:00:00:00" latest="03/06/2019:23:59:59" | rex field=_raw "(?:[^=\n]*=){2}(?P[^ ]+)" | eval date=strftime(_time, "%Y%m%d") | table date, mdn, fullItemID | streamstats count as row | fields row *' -maxout 0 >> output15.log

0 Karma

EricLloyd79
Builder

I tried it without the regex and it produced the same ~3000 rows only.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...