topic Re: I am trying to run CLI searches and output it to a file but its only giving 100 results. in Splunk Search

I am trying to run CLI searches and output it to a file but its only giving 100 results.

jsuryaprakash — Tue, 29 Sep 2020 19:52:16 GMT

Hello Everyone,

I am trying to run below query everyday at 6AM through CLI and output the result to new text file. But it's returning only 100 results. I also tried maxout but its not working and giving me some error, I might be missing something here . Can someone help me to get unlimited results for the query below.

/opt/splunk/bin/splunk search 'index =main sourcetype=employee_data_hcprd earliest=-24h@h latest=now |search HR_STATUS="I" | table EMPLID' > /opt/jobdata.txt

Thanks.
Surya

Re: I am trying to run CLI searches and output it to a file but its only giving 100 results.

Ayn — Fri, 08 Jun 2018 22:19:51 GMT

You need the -maxout switch. By default the CLI will only output 100 results but by using this switch you change that. Set it to 0 if you want to output unlimited results.

https://docs.splunk.com/Documentation/Splunk/7.1.0/Search/ExportdatausingCLI

Re: I am trying to run CLI searches and output it to a file but its only giving 100 results.

jsuryaprakash — Mon, 11 Jun 2018 14:47:10 GMT

Hi Ayn,

I tried it but its but still its returning the 100 results. Can you modify my above query where exactly to add -maxout switch .

Re: I am trying to run CLI searches and output it to a file but its only giving 100 results.

jowenssi — Mon, 11 Jun 2018 15:03:26 GMT

The new query would be:

/opt/splunk/bin/splunk search "index =main sourcetype=employee_data_hcprd earliest=-24h@h latest=now |search HR_STATUS="I" | table EMPLID"  -maxout 0 > /opt/jobdata.txt

Re: I am trying to run CLI searches and output it to a file but its only giving 100 results.

jsuryaprakash — Mon, 11 Jun 2018 15:15:28 GMT

Thanks , got it working.

Re: I am trying to run CLI searches and output it to a file but its only giving 100 results.

jowenssi — Mon, 11 Jun 2018 15:41:56 GMT

The new query would be:

/opt/splunk/bin/splunk search "index =main sourcetype=employee_data_hcprd earliest=-24h@h latest=now |search HR_STATUS=\"I\" | table EMPLID"  -maxout 0 > /opt/jobdata.txt