Splunk DB Connect 2 EPO Limited to 10,000 results?

[ryandg]

I have configured and validated connections for the EPO DB. Everything works great, the query executes and returns data. The issue is that it seems to just sit at the earliest 10,000 results that are stored on the EPO side. I have changed the maximum amount of rows to the stated maximum of 1,000,000 per query and the query is a rising column and set to execute every 10 minutes but if I search the index I always just get the earliest 10,000 results no matter what.

[jcoates_splunk]

is max_rows set? http://docs.splunk.com/Documentation/DBX/2.0.6/DeployDBX/inputsspec

[ryandg]

Yeah the max_rows is set to 1,000,000 -- copied from the Mcafee TA template:

## DB Connect 2 Input Template Stanza ##
[mi_input://ta_mcafee_epo_5_input]
disabled = 0
connection = mcafee
index = epo
interval = * 10 * * *
max_rows = 1000000
output_timestamp_format = YYYY-MM-dd HH:mm:ss
sourcetype = mcafee:epo
source = dbx
mode = tail
query = [truncated for splunk answers]
tail_follow_only = 1
tail_rising_column_name = AutoID
tail_rising_column_number = 2
ui_query_mode = advanced
input_timestamp_column_name = timestamp
input_timestamp_column_number = 1
tail_rising_column_checkpoint_value = 52764329

[ryandg]

Update, today I logged in and there are now 19,000 results ( I have not changed anything, I did edit the Py script middle of last week to not have a hard coded value for max rows). However, it is still months behind what the data should be and I am not sure if this is all the results it should have for the time period it is returning.