Splunk Search

Does stats distinct_count have a limit of distinct values it will count?

dwaddle
SplunkTrust
SplunkTrust

I was working with a search similar to:

my_nifty_search_terms | stats distinct_count(field) by date_hour

and noticed that at least one of my counts stopped conveniently at 100,000. Is this perhaps a hard coded limit somewhere?

Tags (1)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

It is. The limit has been removed in either 4.1.6 or will be removed in 4.2. (Update: limit removed as of 4.1.6.) In the meantime, you can instead do:

my_nifty_search_terms | stats count by field,date_hour | stats count by date_hour

This will not be subject to the limit even in earlier (4.x) versions.


This limit does not exist as of 4.1.6, so you can use distinct_count() (or dc()) even if the result would be over 100,000.

In older versions (4.1.5 and down), you can use:

... | stats distinct_count(f)

can be replaced with

... | stats count by f | stats count

and in general

... | stats dc(f) as g by x,y,z,a,...

can be replaced with

... | stats count as g by f,x,y,z,a,... | stats count as g by x,y,z,a,...

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

It is. The limit has been removed in either 4.1.6 or will be removed in 4.2. (Update: limit removed as of 4.1.6.) In the meantime, you can instead do:

my_nifty_search_terms | stats count by field,date_hour | stats count by date_hour

This will not be subject to the limit even in earlier (4.x) versions.


This limit does not exist as of 4.1.6, so you can use distinct_count() (or dc()) even if the result would be over 100,000.

In older versions (4.1.5 and down), you can use:

... | stats distinct_count(f)

can be replaced with

... | stats count by f | stats count

and in general

... | stats dc(f) as g by x,y,z,a,...

can be replaced with

... | stats count as g by f,x,y,z,a,... | stats count as g by x,y,z,a,...
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...