Splunk Search

dbquery and outputcsv limited to 10,000 results

imarks004
Path Finder

I am trying to create a lookup file daily from data I am pulling with dbquery out of an Oracle Database. If I do the search out of the UI and set the limit=x, I get all the results back. If I do the same search piped to outputcsv, I only get 10,001 results. I am using outputcsv successfully with ldap search to output more 10,000 results, so I cannot see to figure out what is preventing this from working with dbquery.

Thank you.

0 Karma
1 Solution

araitz
Splunk Employee
Splunk Employee

I don't think there is any difference between outputcsv in one app verses another, as outputcsv is a core Splunk search command.

With regard to dbquery, what version of DB Connect are you using? If you run dbquery from the search view and set limit=20000, what happens?

View solution in original post

0 Karma

araitz
Splunk Employee
Splunk Employee

I don't think there is any difference between outputcsv in one app verses another, as outputcsv is a core Splunk search command.

With regard to dbquery, what version of DB Connect are you using? If you run dbquery from the search view and set limit=20000, what happens?

0 Karma

imarks004
Path Finder

I am running version 1.1.1. So after just playing around with this a little more, it does not seem that outputcsv is limiting this, it is more likely the table command. If I run the ouputcsv right after the dbquery with a limit=1000000 set, it does dump everything. I am trying to use table command to filter just the fields I wanted passed to the CSV. I just updated the sql query to limit the results returned back and can now skip the table command.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...