topic Re: After upgrading to 5.0.3, I can only export 100 lines of csv via UI. in Getting Data In

After upgrading to 5.0.3, I can only export 100 lines of csv via UI.

the_wolverine — Tue, 16 Jul 2013 19:24:43 GMT

Upgraded from 4.3.x to 5.0.3 this week and noticed that exporting from UI only produces 100 lines of CSV. Yes, I checked "Unlimited" and even tried checking the 10000 lines option.

Using * | outputcsv myfile.csv produces a csv file with the correct number of lines (more than 100).

Re: After upgrading to 5.0.3, I can only export 100 lines of csv via UI.

Chubbybunny — Tue, 16 Jul 2013 23:48:36 GMT

limits.conf

  [restapi]
    # maximum result rows to be returned by /events or /results getters from REST API  
    maxresultrows = 50000

you'll need to increase that, enjoy!

(\__/)
(='.'=)
(")_(")
*shout-out to Rob C. too!

Re: After upgrading to 5.0.3, I can only export 100 lines of csv via UI.

Rob — Tue, 16 Jul 2013 23:52:28 GMT

Thx Chubbybunny

Re: After upgrading to 5.0.3, I can only export 100 lines of csv via UI.

the_wolverine — Wed, 17 Jul 2013 00:10:29 GMT

So the setting that we used in version 4.3.x did not affect EXPORT but it does in version 5.0?

Re: After upgrading to 5.0.3, I can only export 100 lines of csv via UI.

bfernandez — Mon, 28 Sep 2020 16:12:14 GMT

It is not taking the maxout configuration that is 100 events in a search query by defafult.
Try this CLI example:

Without maxout:

./splunk search "| savedsearch name" -output csv > /data/test/export.csv

(in jobs view) | savedsearch Datos_Grupo_9 | head 100 | export add_timestamp=f add_offset=t format=csv segmentation=raw

With maxout:
./splunk search "| savedsearch name" -output csv -maxout 0 > /data/test/export.csv

(in jobs view) | savedsearch Datos_Grupo_9 | export add_timestamp=f add_offset=t format=csv segmentation=raw