oneshot limit java

scott_r — Fri, 01 Oct 2021 17:44:22 GMT

If I am trying to execute the following code block and my total records is greater than 50K it limits me to the 50K so is there a modified example of this through an offset or pagination technique someone can provide that will allow me to iterate through the full result set beyond the 50k

oneshotSearchArgs.put("earliest_time", yesterday+"T05:00:00.000" );
oneshotSearchArgs.put("latest_time", today+"T05:00:00.000" );
oneshotSearchArgs.put("count", 0);
String oneshotSearchQuery = "search " + searchString;

// The search results are returned directly
InputStream results_oneshot = service.oneshotSearch(oneshotSearchQuery, oneshotSearchArgs);

// Get the search results and use the built-in XML parser to display them
ResultsReaderXml resultsReader = new ResultsReaderXml(results_oneshot);
HashMap<String, String> event;
int eventsMatched = 0;
String log = null;
ArrayList<String> list = new ArrayList<>();
while ((event = resultsReader.getNextEvent()) != null) {

}

Re: oneshot limit java

kamlesh_vaghela — Mon, 04 Oct 2021 05:32:56 GMT

@scott_r

50K is default limits of searchresults stanza. You can change it as per your requirements and try again.

maxresultrows = <integer>
* Configures the maximum number of events are generated by search commands
  which grow the size of your result set (such as multikv) or that create
  events. Other search commands are explicitly controlled in specific stanzas
  below.
* This limit should not exceed 50000.
* Default: 50000

Please check this limits.conf doc for more information.

searchresults

https://docs.splunk.com/Documentation/Splunk/8.2.2/Admin/Limitsconf#.5Bsearchresults.5D

Thanks
KV
▄︻̷̿┻̿═━一 😉

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

topic oneshot limit java in Splunk Search

oneshot limit java

Re: oneshot limit java