topic Re: Splunk Enterprise Security: Threat Intelligence list export limitation at 10,000 record? in Splunk Enterprise Security

Splunk Enterprise Security: Threat Intelligence list export limitation at 10,000 record?

owenpcyip — Fri, 08 Dec 2017 09:47:46 GMT

I can see that there are over 10000 record per list (Threat Intelligence) in Splunk ES Web UI. But I can ONLY export 10000 records per list. May I know if there is a limitation on that (max. 10000 record per list) instead of parse or normalize 10000 records ONLY. Thanks.

Re: Splunk Enterprise Security: Threat Intelligence list export limitation at 10,000 record?

pleymort — Fri, 08 Dec 2017 14:13:40 GMT

Hi,

You can find the answer in another post :
https://answers.splunk.com/answers/371296/how-do-i-get-more-than-10000-results-in-the-csv-fi.html

Regards,

Re: Splunk Enterprise Security: Threat Intelligence list export limitation at 10,000 record?

nabeel652 — Sat, 09 Dec 2017 10:21:23 GMT

Are you using "sort" command somewhere in your query? That limits the records to 10,000 by default. Use zero like "Sort 0 field1 field2" to include all records.

Re: Splunk Enterprise Security: Threat Intelligence list export limitation at 10,000 record?

owenpcyip — Mon, 11 Dec 2017 02:34:21 GMT

Thanks, I try it now.

Re: Splunk Enterprise Security: Threat Intelligence list export limitation at 10,000 record?

owenpcyip — Mon, 11 Dec 2017 02:37:23 GMT

Thank you for the link but I am not sure for the configuration file location. I tried to find the file "savedsearched.conf" and got some results.

Re: Splunk Enterprise Security: Threat Intelligence list export limitation at 10,000 record?

owenpcyip — Fri, 15 Dec 2017 02:42:42 GMT

I means I cannot to export my TI from the ES, the menu path as below

Splunk > App: Enterprise Security > Threat Artifacts >

Then, I get my TI result and would like to export it (over 10,000 records are there) to csv format but finally I just get only 10,000 records from the csv.

Re: Splunk Enterprise Security: Threat Intelligence list export limitation at 10,000 record?

owenpcyip — Fri, 15 Dec 2017 02:42:50 GMT

I means I cannot to export my TI from the ES, the menu path as below

Splunk > App: Enterprise Security > Threat Artifacts >

Then, I get my TI result and would like to export it (over 10,000 records are there) to csv format but finally I just get only 10,000 records from the csv.

Re: Splunk Enterprise Security: Threat Intelligence list export limitation at 10,000 record?

owenpcyip — Fri, 15 Dec 2017 02:42:59 GMT

I means I cannot to export my TI from the ES, the menu path as below

Splunk > App: Enterprise Security > Threat Artifacts >

Then, I get my TI result and would like to export it (over 10,000 records are there) to csv format but finally I just get only 10,000 records from the csv.