topic Re: Powershell Resource kit Search has Max 100 results in Getting Data In

Powershell Resource kit Search has Max 100 results

jkcouch — Tue, 31 Jul 2012 19:56:10 GMT

I have been playing around with the powershell resource kit, trying to use it as a searching interface to use with automation. I am trying to get results in exess of 100 events. Even with the use of the -MaxReturnCount option, it only returns up to 100 (allows to decrease from 100, but not increase above). I have found several other posts on modifying this but not in the powershell resource kit.

As I look at the splunk-core .psm1 file i can see where we could edit the $PostString variable, but thought I should report this as a possible bug.

Example script:

$credential = Get-Credential
Connect-Splunk -Credential $credential –ComputerName Computername
$connection = Get-SplunkConnectionObject
$search = $Connection | Search-Splunk -Search 'source="PS_VMHost_Config" earliest=-10d@d latest=now'-MaxTime 30 -MaxReturnCount 30 -Verbose

Any assistance would be great!

Re: Powershell Resource kit Search has Max 100 results

bsonposh — Tue, 31 Jul 2012 20:22:44 GMT

Thanks jkcouch. I will get this fixed. I thought we added an override for this but I believe you are you correct.

Re: Powershell Resource kit Search has Max 100 results

jkcouch — Tue, 31 Jul 2012 20:24:44 GMT

Thanks Brandon!

Re: Powershell Resource kit Search has Max 100 results

cohatch — Tue, 11 Dec 2012 14:17:35 GMT

Any update on this? Thanks.

Re: Powershell Resource kit Search has Max 100 results

cohatch — Tue, 11 Dec 2012 17:08:05 GMT

It seems the powershell parameter maxreturncount creates the header addition "max_count=" when it should simply add "count="

Re: Powershell Resource kit Search has Max 100 results

jkcouch — Thu, 03 Jan 2013 15:49:47 GMT

cohatch - that fixed it for me too. Thanks!

Re: Powershell Resource kit Search has Max 100 results

halr9000 — Thu, 03 Jan 2013 15:57:56 GMT

@cohatch, why don't you type this up as an Answer so that others can vote on it. I assume that you are talking about changing splunk-search.psm1, line 93 from "max_count" to "count", correct? Write that up as an answer, confirm that you've tested it, and I'll commit it to Github. TIA

Re: Powershell Resource kit Search has Max 100 results

Drainy — Thu, 03 Jan 2013 16:02:42 GMT

Switcharooed to an answer

Re: Powershell Resource kit Search has Max 100 results

halr9000 — Thu, 03 Jan 2013 16:05:06 GMT

TY Drainy 🙂

Re: Powershell Resource kit Search has Max 100 results

halr9000 — Thu, 03 Jan 2013 16:07:16 GMT

Fix committed. Test please! https://github.com/splunk/splunk-reskit-powershell/archive/master.zip