All Apps and Add-ons

Splunk DB Connect 2 EPO Limited to 10,000 results?


I have configured and validated connections for the EPO DB. Everything works great, the query executes and returns data. The issue is that it seems to just sit at the earliest 10,000 results that are stored on the EPO side. I have changed the maximum amount of rows to the stated maximum of 1,000,000 per query and the query is a rising column and set to execute every 10 minutes but if I search the index I always just get the earliest 10,000 results no matter what.

0 Karma

Splunk Employee
Splunk Employee
0 Karma


Yeah the max_rows is set to 1,000,000 -- copied from the Mcafee TA template:

## DB Connect 2 Input Template Stanza ##
disabled = 0
connection = mcafee
index = epo
interval = * 10 * * *
max_rows = 1000000
output_timestamp_format = YYYY-MM-dd HH:mm:ss
sourcetype = mcafee:epo
source = dbx
mode = tail
query = [truncated for splunk answers]
tail_follow_only = 1
tail_rising_column_name = AutoID
tail_rising_column_number = 2
ui_query_mode = advanced
input_timestamp_column_name = timestamp
input_timestamp_column_number = 1
tail_rising_column_checkpoint_value = 52764329
0 Karma


Update, today I logged in and there are now 19,000 results ( I have not changed anything, I did edit the Py script middle of last week to not have a hard coded value for max rows). However, it is still months behind what the data should be and I am not sure if this is all the results it should have for the time period it is returning.

0 Karma
Get Updates on the Splunk Community!

Tips & Tricks When Using Ingest Actions

Tune in to learn about:Large scale architecture when using Ingest ActionsRegEx performance considerations ...

Announcing Our Splunk MVPs

We are excited to announce the first cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...