topic Re: Search event count limited from REST API but not UI search in Splunk Search

Search event count limited from REST API but not UI search

tabchb — Thu, 10 Feb 2011 12:11:48 GMT

Hi,

I'm running a search as follows via the Splunk Web UI ie. search index="xxxx" sourcetype="some_gateway" for a given day(24hrs) and it returns say >500,000 results, but the same search queried from the REST API stops early at 173,889 results every time. How can I increase this number and why is the UI query different?

Thanks

Re: Search event count limited from REST API but not UI search

tabchb — Thu, 10 Feb 2011 16:02:04 GMT

adding the magic status_buckets = 300 parameter to the search create command seems to have allowed me to bust through the limit

Re: Search event count limited from REST API but not UI search

tabchb — Thu, 10 Feb 2011 16:24:22 GMT

Nope new limit at 400,000

Re: Search event count limited from REST API but not UI search

steveyz — Fri, 11 Feb 2011 01:57:28 GMT

Are you trying to export the events as a csv file?

Re: Search event count limited from REST API but not UI search

tabchb — Fri, 11 Feb 2011 15:28:35 GMT

No, trying to extract directly via the Http REST API. Not to worry I probably just need to limit the scope of my search to lower time intervals - say 1 hour at time.

Re: Search event count limited from REST API but not UI search

steveyz — Sat, 12 Feb 2011 02:11:59 GMT

The search should definitely not be stopping. You could check search.log in the job's dispatch directory to see if there's message indicating why the job stopped.

Re: Search event count limited from REST API but not UI search

karan1337 — Sun, 05 Jul 2015 23:35:20 GMT

Events are different from results. I was also hitting a similar limit of 500,000 events in my REST API. Try appending | table * to your search and check the number of events you are getting.

Re: Search event count limited from REST API but not UI search

santos_solorzan — Tue, 26 Jul 2016 19:14:48 GMT

THIS WORKED FOR ME - thanks so much karan1337 🙂