topic Re: Export results from KV lookup file in Lookup editor in Splunk Search

Export results from KV lookup file in Lookup editor?

smanojkumar — Thu, 23 Feb 2023 17:51:23 GMT

Hi There,

I would like to export the results of kv lookup file in a lookup editor, but the results after exporting is only 50k records, even the original results is 80k records, How to download the entire results in a single file?

Thanks!

Re: Export results from KV lookup file in Lookup editor

gcusello — Tue, 21 Feb 2023 13:11:36 GMT

Hi @smanojkumar,

are you trying to export rows from a KV Store lookup using the inputlookup command or the Lookup Editor App?

Inputllokup has the limit of 50,000 results, but the export from the Lookup Editor shouldn't have this limit.

Ciao.

Giuseppe

Re: Export results from KV lookup file in Lookup editor

smanojkumar — Thu, 23 Feb 2023 07:40:56 GMT

I'm trying to use lookup Editor app.

Re: Export results from KV lookup file in Lookup editor

gcusello — Thu, 23 Feb 2023 07:46:14 GMT

Hi @smanojkumar,

at first see if the solution from @woodcock solves your requirement https://community.splunk.com/t5/Splunk-Search/How-can-I-escape-the-50K-subsearch-limit-while-linking-commands/m-p/275324

otherwise, you could modify limits.conf:

[searchresults] maxresultrows = 100000 [stats] maxresultrows = 100000 [top] maxresultrows = 100000

Ciao.

Giuseppe

Re: Export results from KV lookup file in Lookup editor

smanojkumar — Thu, 23 Feb 2023 08:21:26 GMT

We need to modify in all these 3 places in limits.config file? [searchresults] maxresultrows = 100000 [stats] maxresultrows = 100000 [top] maxresultrows = 100000

Re: Export results from KV lookup file in Lookup editor

smanojkumar — Mon, 27 Feb 2023 11:26:32 GMT

Actually, i'm having same configuration in test environment but the lookup editor is working fine, but it is not working in dev environment, any other things or ways to increase the export records count.