Splunk Search

Exporting more than 50k rows in lookup editor app?

smanojkumar
Contributor

Hi There!

   I would like to export more than 50k rows in lookup editor app of the results of kv store lookup file, 

   I tried even changing the limits.config file, but it is not working fine,

[searchresults]
maxresultrows = 500000
[stats]
maxresultrows = 500000
[top]
maxresultrows = 500000

Can anyone say about the solution for this?

 

Thanks in Advance!

Labels (1)
0 Karma

shivanshu1593
Builder

Hello @smanojkumar ,

Lookups can have millions of results, especially the KVStore lookup. Looks like the SPL that you wrote, whose' results you're trying to output to the lookup is truncating your results. Can be caused either by using the sort command or append, join or even subsearches. Could you share your SPL, masking sensitive information in it, so that we could try to identify the problem.

Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
0 Karma

smanojkumar
Contributor

We are having the same query and configuration in dev and prod environment, where us in dev it is working fine, we can export more than 50k records but not in prod environment, since we are having same query in prod environment as well.
Any other things that restrict the export more than 50k records?

Any other reason which can cause this issue.

I would like to know, Is that something related to licensing, also I can see version in prod and dev are same.

 

Thanks in Advance!

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.0.2 Availability: On cloud and On-premise!

A few months ago, we released Splunk Enterprise Security 8.0 for our cloud customers. Today, we are excited to ...

Logs to Metrics

Logs and Metrics Logs are generally unstructured text or structured events emitted by applications and written ...

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...