topic Re: How can I increase the output count limit for the command.script component? in Getting Data In

How can I increase the output count limit for the command.script component?

ctaf — Mon, 23 Jan 2017 15:36:38 GMT

Hi,

I have a search that is using the "script" command but this search is exceeding a limit as you can see:

Is there a way to increase this limit?
I tried maxinputs of the commands.conf file but without any luck.

Any guess?
Thank you.

Re: How can I increase the output count limit for the command.script component?

gcusello — Mon, 23 Jan 2017 15:45:20 GMT

Hi ctaf,
could you share your search? because maybe the problem is in another parameter (e.g. sort is limited to 10k events) and there are other parameters to set (e.g. maxresultrows or maxresultrows or subsearch_maxout in join, etc...) in limits.conf.
Bye.
Giuseppe

Re: How can I increase the output count limit for the command.script component?

ctaf — Mon, 23 Jan 2017 15:49:20 GMT

It's quite simple:

 search index=XXX | table XXXX  | stats XXX | lookup XXX | script python YYYY arg

There is no join or sort...

I saw maxresultrows but there is no "script" stanza...

Re: How can I increase the output count limit for the command.script component?

gcusello — Mon, 23 Jan 2017 16:00:59 GMT

if you don't use script command, have you always the same limit?
in addition, you don't need to use the table command before a stats command (it only reduces speed of your search).
Bye.
Giuseppe

Re: How can I increase the output count limit for the command.script component?

ctaf — Mon, 23 Jan 2017 16:14:39 GMT

There is no command.script component if I don't use it...

Re: How can I increase the output count limit for the command.script component?

gcusello — Mon, 23 Jan 2017 16:27:14 GMT

Have you seen the limits in command.conf file for your script use?
There are:

maxinputs = <integer>
* Maximum number of events that can be passed to the command for each
  invocation.
* This limit cannot exceed the value of maxresultrows in limits.conf.
* 0 for no limit.
* Defaults to 50000.

maximum data that can be passed to command (0 = no limit)
MAXINPUTS = 50000

Bye.
Giuseppe

Re: How can I increase the output count limit for the command.script component?

ctaf — Mon, 23 Jan 2017 16:28:56 GMT

Giuseppe,

As I wrote on my original post, I already tried it.