Getting Data In

API limits to 100 results

sondradotcom
Path Finder

I'm using the API via the php sdk. Things are going well except for one thing -- I can never get more than 100 results. When I'm running a timechart query, for example, for a period of a week and a span of 1 hour, I should get 168 results but it stops at 100. Any thoughts?

Thanks! -S.

Tags (1)

vikiitd
New Member

hi i am facing the same issue with java sdk but don't see a count argument supported for the getResults() function. It only takes a map as a argument. Any idea on how to handle this issue in java sdk. Help much appreciated!

Thanks!

0 Karma

lpolo
Motivator
0 Karma

lpolo
Motivator

I am facing the same issue...

0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

To retrieve more than 100 results, you can set the limit higher in the API request using the count argument. For the PHP SDK, you can pass in the count parameter to the getResults() function. To page through the result set, you can use both the offset and count GET arguments to the API.

To make sure that these are being properly passed by the SDK, you should watch what's written to splunkd_access.log and verify that the GET arguments are in the requested URLs.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Developer Spotlight with Denis Gladkikh

From Splunk Engineer to Kubernetes App Builder Denis GladkikhWhat happens when a lifelong developer turns a ...

Governing Enterprise AI, Bringing Cisco Telemetry Home, and More from Splunk Lantern

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...