<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: max result lookups in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/max-result-lookups/m-p/377384#M110727</link>
    <description>&lt;P&gt;You can try below syntax in &lt;STRONG&gt;/opt/splunk/etc/system/local/limits.conf&lt;/STRONG&gt; and check the change in results.&lt;/P&gt;

&lt;P&gt;&lt;STRONG&gt;[searchresults]&lt;BR /&gt;
max_mem_usage_mb = 400&lt;BR /&gt;
maxresultrows = 10000000&lt;BR /&gt;
tocsv_maxretry = 10&lt;BR /&gt;
tocsv_retryperiod_ms = 1000&lt;/STRONG&gt;&lt;/P&gt;</description>
    <pubDate>Tue, 29 Sep 2020 22:37:12 GMT</pubDate>
    <dc:creator>bhavikbhalodia</dc:creator>
    <dc:date>2020-09-29T22:37:12Z</dc:date>
    <item>
      <title>max result lookups</title>
      <link>https://community.splunk.com/t5/Splunk-Search/max-result-lookups/m-p/377383#M110726</link>
      <description>&lt;P&gt;good afternoon&lt;/P&gt;

&lt;P&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp; I have a lookups that has 11737540 lines, but when I see it in splunk, it only shows me half&lt;/P&gt;

&lt;P&gt;| inputlookup msisdn_sus_Todos.csv&lt;/P&gt;

&lt;P&gt;5,004,673 results&lt;/P&gt;

&lt;P&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp; Does anyone have any idea how to fix this? that all the values are shown or you have to increase some value in the limits.conf&lt;/P&gt;

&lt;P&gt;regards&lt;/P&gt;</description>
      <pubDate>Tue, 29 Sep 2020 21:55:26 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/max-result-lookups/m-p/377383#M110726</guid>
      <dc:creator>efaundez</dc:creator>
      <dc:date>2020-09-29T21:55:26Z</dc:date>
    </item>
    <item>
      <title>Re: max result lookups</title>
      <link>https://community.splunk.com/t5/Splunk-Search/max-result-lookups/m-p/377384#M110727</link>
      <description>&lt;P&gt;You can try below syntax in &lt;STRONG&gt;/opt/splunk/etc/system/local/limits.conf&lt;/STRONG&gt; and check the change in results.&lt;/P&gt;

&lt;P&gt;&lt;STRONG&gt;[searchresults]&lt;BR /&gt;
max_mem_usage_mb = 400&lt;BR /&gt;
maxresultrows = 10000000&lt;BR /&gt;
tocsv_maxretry = 10&lt;BR /&gt;
tocsv_retryperiod_ms = 1000&lt;/STRONG&gt;&lt;/P&gt;</description>
      <pubDate>Tue, 29 Sep 2020 22:37:12 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/max-result-lookups/m-p/377384#M110727</guid>
      <dc:creator>bhavikbhalodia</dc:creator>
      <dc:date>2020-09-29T22:37:12Z</dc:date>
    </item>
  </channel>
</rss>

