topic Re: Search using C# sdk is returning only 50000 events in Splunk Search

Search using C# sdk is returning only 50000 events

ykmohank — Fri, 17 Jan 2014 06:52:02 GMT

Hi,

From Splunk web interface a saved search is returning around 300,000+ events. While calling the same saved search from C# SDk it is returning only 50,000 events.

Please help me on why i am getting only 50,000 events and how can i read remaining events.

Below is the code that i am referring to.

    var connectArgs = new ServiceArgs
            {
                Host = "myhost.com",
                Port = myportNumber

            };

            // Create new Service object
            Service service = new Service(connectArgs);


            service.Login("admin", "password");


            SavedSearch ObsSearch = service.GetSavedSearches().Get("SavedSearchName");

            Job searchJob = ObsSearch.Dispatch();


            while (!searchJob.IsDone)
            {
                try
                {
                    Thread.Sleep(500);
                }
                catch (Exception ex)
                {
                    Console.WriteLine("Exception Occured :" + ex.ToString());
                    Console.ReadLine();
                }
            }


            JobResultsPreviewArgs previewArgs = new JobResultsPreviewArgs();
            previewArgs.OutputMode = JobResultsPreviewArgs.OutputModeEnum.Xml;
            previewArgs.Count = 0;

            int count = 0;


            using (var stream = searchJob.ResultsPreview(previewArgs))
            {
                using (var rr = new ResultsReaderXml(stream))
                {
                    foreach (var @event in rr)
                    {

                        count ++;
                    }

                }

            }

System.Console.WriteLine("Total events " + count.ToString())

Thanks in advance.

Regards,
Mohan

Re: Search using C# sdk is returning only 50000 events

Damien_Dallimor — Fri, 17 Jan 2014 09:16:49 GMT

50,000 events is the default resultset size to return , as set in the maxresultrows property.

See in limits.conf

It is not recommended to change this.

Rather , in your SDK code you should implement a paging algorithm.

You can reference how to do this in C Sharp here. Scroll down to the "To paginate through a large set of results" section of the page.

Re: Search using C# sdk is returning only 50000 events

ykmohank — Fri, 17 Jan 2014 11:42:12 GMT

Thanks for your reply.
I tried paginate option and with this i was able to download 500,000 events where as in reality web interface is returning me 703,186 events.

Is there any other way on getting the remaining records as well.

Job.ResultCount is returning value as 500,000 only.

Pelase help.