topic What conf files must I update to change the 50000 limit for external scripts? in Getting Data In

What conf files must I update to change the 50000 limit for external scripts?

andrewtrobec — Tue, 30 Jan 2018 18:23:19 GMT

Hello,

I currently have an external python script that is called by my search to manipulate data. Everything works except I've noticed that the Statistics tab is limiting the number of results to 50000. I've found a number of threads that address limits of 50000, but none that will help to raise the upper limit for script calls.

I've tried to add a [default] stanza to my local commands.conf where i set maxinputs = 0, but that has had no effect.

Could someone help me understand which conf files I need to update?

Thank you!

Andrew

Re: What conf files must I update to change the 50000 limit for external scripts?

493669 — Tue, 30 Jan 2018 18:30:53 GMT

Hi @andrewtrobec,
Have you tried to to add this in limits.conf present at $SPLUNK_HOME/etc/system/local/

[searchresults] 
maxresultrows = 100000
[stats]
maxresultrows = 100000
[top]
maxresultrows = 100000

Re: What conf files must I update to change the 50000 limit for external scripts?

andrewtrobec — Tue, 30 Jan 2018 21:07:21 GMT

This did the trick!

Also, for reference I had to update commands.conf in $SPLUNK_HOME/etc/apps/<app_name>/local to:

[default]
maxinputs = 0
maxresultrows = 100000

Regards,

Andrew