Splunk Search

Why is there a 10000 rows limit?

jiaqya
Builder

I ran a search which should show more than 10000 rows, but I get only 10000 rows back on the result.
Is this a limitation?

Tags (2)
1 Solution

vnravikumar
Champion

Hi

Are you using sort command? It defaults results to 10K, but you can unlimit it by using sort 0.

View solution in original post

drabbit
Explorer

and how do I export more than 10.000 rows if I want them sorted by timestamp? That is a necessary sort because Splunk default behaviour is to sort rows in wrong order.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

You should use "sort 0" instead of sort. See more https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Sort

r. Ismo

drabbit
Explorer

thanks! That solves the issue. And "sort 0 _time" doesn't have the flaw that reverse has.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Use reverse instead

| reverse
0 Karma

drabbit
Explorer

reverse is bugged. Big blocks of log lines are several hours shifted away from where they should be. I recommend to never use it.

0 Karma

aholzer
Motivator

You are likely running a join or something similar. All the limits are configured under limits.conf. Be very careful about changing them though because they can have a big impact on performance!

There are ways of doing joins without the "join" command. I suggest you post the search you are trying to perform so that someone can help you build out the more efficient search without the join.

Hope this helps

0 Karma

anil1432
Explorer

Can you please solve the query .

Issue with limits.conf

(host=wscreenapi3* OR host=tracking-api-release) name="RegisteredUserLog" earliest=-60d@d latest=-30d@d id!=3000000010 | fields event_id platform | fields - _raw | stats count by event_id platform | dedup event_id | rename event_id as easy_id | table easy_id platform | join type=left easy_id [search (host=wscreenapi3* OR host=tracking-api-release) name="RegisteredUserLog" earliest=-30d@d latest=@d id!=3000000010 | fields event_id | fields - _raw | stats count by event_id | rename event_id as easy_id | table easy_id | eval retentionFlg=1] | eval

 platform_str=if(platform="0","Android",if(platform="1","iPhone",if(platform="2","Web (Android)",if(platform="3","Web (iPhone)","Unknown"))))| stats count(easy_id) as basedUserCount sum(retentionFlg) as retentionUserCount by platform_str | addcoltotals labelfield=platform_str | eval customerChurnRate=(basedUserCount - retentionUserCount) / basedUserCount * 100 |eval baseUserListDateFrom = strftime(relative_time(now(),"-60d@d"), "%Y/%m/%d")." 00:00:00" |eval baseUserListDateTo = strftime(relative_time(now(),"-31d@d"), "%Y/%m/%d")." 23:59:59" |eval compareUserListDateFrom = strftime(relative_time(now(),"-30d@d"), "%Y/%m/%d") ." 00:00:00" |eval compareUserListDateTo = strftime(relative_time(now(),"-1d@d"), "%Y/%m/%d") ." 23:59:59" | table baseUserListDateFrom baseUserListDateTo compareUserListDateFrom compareUserListDateTo platform_str basedUserCount retentionUserCount customerChurnRate

0 Karma

jiaqya
Builder

thanks for your reply, it was the usage of sort which was causing it..

0 Karma

vnravikumar
Champion

Hi

Are you using sort command? It defaults results to 10K, but you can unlimit it by using sort 0.

jiaqya
Builder

Thanks, it was the sort usage.. its fixed now..

0 Karma

acrif
New Member

Hi, how did you fixed the issue?

 

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...