Splunk truncated this search at {count} resu...

Warnings reference › source.splunk.truncated

Identifier

source.splunk.truncated

Raised by

The grid (core)

Since

1.72.0

What happened

The search job reported a ceiling: it reached the instance's maxresultrows, was auto-finalized, or said so in one of its messages. The count Splunk returned is used as the total because it is the only number there is, and it is smaller than the number of events that matched - so every "showing X of Y" reads low until the search is narrowed. The same key is also raised in mode: 'export' when maxResultRows stops the stream early, with its own wording naming the row count and the option, since an export has no total to misreport.

The fix

Narrow the search or the time window, raise maxresultrows in the instance's limits.conf, or read the whole result with mode: 'export'. Setting maxResultRows to your instance's ceiling lets the adapter spot a truncation Splunk did not announce - in export mode it also stops the stream at that ceiling.

The smallest fix

splunkAdapter({ url, search, maxResultRows: 500000 });

Reference

Covered in full at the API reference.