DEV Community

Maxime Guilbert
Maxime Guilbert

Posted on • Edited on

2 1

Splunk - 10K rows limit

While you are doing requests in Splunk, especially for dashboards, you will try to optimize it and reuse as much as possible.

But, if you are doing this, be sure that the common request doesn't contains a sort operator if you don't need to. Because the usage of the sort operator will automatically limit you at the first 10K rows for your search.

So if you want to generate a dashboard showing :

  • the number of calls
  • the timechart
  • ...
  • and the last logs be sure that you only have the sort on the subrequest that show the logs.

Otherwise you will see only 10k in the number of calls and a hole in your timechart.


I hope it will help you! 🍺


You want to support me?

Buy Me A Coffee

Image of Timescale

🚀 pgai Vectorizer: SQLAlchemy and LiteLLM Make Vector Search Simple

We built pgai Vectorizer to simplify embedding management for AI applications—without needing a separate database or complex infrastructure. Since launch, developers have created over 3,000 vectorizers on Timescale Cloud, with many more self-hosted.

Read more

Top comments (1)

Collapse
 
lweiss01 profile image
lweiss01 •

You can override the 10k limit on sorted results:

| sort 0 <your-sort-field>
Enter fullscreen mode Exit fullscreen mode

Using 0 will override the 10k limit. Any other positive integer will limit the results to that number of results.

Image of Timescale

🚀 pgai Vectorizer: SQLAlchemy and LiteLLM Make Vector Search Simple

We built pgai Vectorizer to simplify embedding management for AI applications—without needing a separate database or complex infrastructure. Since launch, developers have created over 3,000 vectorizers on Timescale Cloud, with many more self-hosted.

Read more