size limit on REST response?

[hgehrts_splunk]

Hi

It seems to me that larger REST responses get cut off. Is there a configurable size limit on responses? Or is this the timeout setting?
What does the streaming_request option do?

BR
Henning

[salvadormadi]

This is what I see on debug mode for the processing of the API response:

2020-12-02 13:48:29,640 +0000 log_level=DEBUG, pid=27846, tid=Thread-4, file=ext.py, func_name=std_output, code_line_no=187 | [stanza_name="SPLKTEST"] Writing events to stdout finished.

2020-12-02 13:48:29,638 +0000 log_level=DEBUG, pid=27846, tid=Thread-4, file=engine.py, func_name=_on_post_process, code_line_no=170 | [stanza_name="SPLKTEST"] Got 2 tasks need to be executed after process

2020-12-02 13:48:29,638 +0000 log_level=DEBUG, pid=27846, tid=Thread-4, file=models.py, func_name=calculate, code_line_no=243 | [stanza_name="SPLKTEST"] Calculated result: False

2020-12-02 13:48:29,637 +0000 log_level=DEBUG, pid=27846, tid=Thread-4, file=ext.py, func_name=json_path, code_line_no=98 | [stanza_name="SPLKTEST"] Got 1 elements extracted with JSONPATH expression "$"

2020-12-02 13:48:29,623 +0000 log_level=DEBUG, pid=27846, tid=Thread-4, file=ext.py, func_name=json_path, code_line_no=80 | [stanza_name="SPLKTEST"] source expected is a JSON, not <class 'str'>. Attempt to convert it to JSON

2020-12-02 13:48:29,622 +0000 log_level=DEBUG, pid=27846, tid=Thread-4, file=ext.py, func_name=_parse_json, code_line_no=199 | [stanza_name="SPLKTEST"] Try to extract JSON from source with JSONPATH expression: $,

2020-12-02 13:48:29,622 +0000 log_level=DEBUG, pid=27846, tid=Thread-4, file=models.py, func_name=calculate, code_line_no=238 | [stanza_name="SPLKTEST"] Calculating condition with method: [json_empty], input size: [2]

2020-12-02 13:48:27,791 +0000 log_level=DEBUG, pid=27846, tid=Thread-4, file=engine.py, func_name=_on_pre_process, code_line_no=154 | [stanza_name="SPLKTEST"] Got 0 tasks need be executed before process

[salvadormadi]

Hello @paramagurukarth. I've tried the count=0 and it doesn't work for me.

If I put the api response on a text file, it does indexed perfectly. However, when using the rest api response (built with the add-on builder) it doesn't work. Any other suggestions? 
Could it be something to do with asynchronous/synchronous api modes? 
Thanks,

[Damien_Dallimor]

You will have to set the TRUNCATE property in props.conf for very large events.

See this answer here.

https://answers.splunk.com/answers/4162/size-limit-for-an-event.html

[paramagurukarth]

Send "count" as "0" along with your rest end point....

count parameter defines the number of entries...

count = 0 means everything 😛

i.e.
https://localhost:8089/servicesNS/-/MyApplication/data/ui/views?count=0