Splunk truncated this search at {count} resu...

Warnings reference › source.splunk.truncated

Identifier

source.splunk.truncated

Raised by

The grid (core)

Since

1.72.0

What happened

The search job reported a ceiling: it reached the instance's maxresultrows, was auto-finalized, or said so in one of its messages. The count Splunk returned is used as the total because it is the only number there is, and it is smaller than the number of events that matched - so every "showing X of Y" reads low until the search is narrowed.

The fix

Narrow the search or the time window, raise maxresultrows in the instance's limits.conf, or read the whole result with mode: 'export'. Setting maxResultRows to your instance's ceiling lets the adapter spot a truncation Splunk did not announce.

The smallest fix

splunkAdapter({ url, search, maxResultRows: 500000 });

Reference

Covered in full at the API reference.