topic Re: External Lookup 100 row limit in Getting Data In

External Lookup 100 row limit

ConsoleBotTryPC — Tue, 21 Nov 2023 17:34:02 GMT

Hi,

I am using an external lookup to basically run a Python script which runs an API call to return the results using a csv.dictwriter to the sys.stdout.

There are around 1250 rows being written to the console
But only the first 100 rows are being shown in Splunk.

How can I disable this 100-row limit on external lookups?

Thank you and have a nice day,

Best,

ConsoleBotTryPC — Tue, 21 Nov 2023 17:36:39 GMT

ConsoleBotTryPC — Tue, 21 Nov 2023 17:39:17 GMT

Also had found about the keyword to be added in transforations.conf

max_matches

but this has an upper limit of 1000. I need more...

PickleRick — Tue, 21 Nov 2023 21:53:21 GMT

You can't have more. You might be able to "walk around" this limitation by writing custom command - it's bound by other rules than scripted lookup.