Extending Splunk - Implementing Splunk: Big Data Reporting and Development for Operational Intelligence - page 394

With my test data, this produced 132 rows, representing 132 unique words at least
3 characters long in my not-so-random data set. count represents how many times
each word occurred overall, while Events with word represents how many events
contained the word at all.
Notice the value 50000 in the Event count column. Even though my
query found more than 300,000 events, only 50,000 make their way to the
command. You can increase this limit by increasing maxresultrows in
limits.conf , but be careful! This limit is for your protection.
Trying out our options as follows:
* | head 1000
| countwords casesensitive=true mincount=250 minwordlength=0
This query produces the following output:
Notice that we now see one-and two-letter words, have entries for both T and t ,
and our results stop when count drops below our value for mincount .