Getting Data In

API limits to 100 results

sondradotcom
Path Finder

I'm using the API via the php sdk. Things are going well except for one thing -- I can never get more than 100 results. When I'm running a timechart query, for example, for a period of a week and a span of 1 hour, I should get 168 results but it stops at 100. Any thoughts?

Thanks! -S.

Tags (1)

vikiitd
New Member

hi i am facing the same issue with java sdk but don't see a count argument supported for the getResults() function. It only takes a map as a argument. Any idea on how to handle this issue in java sdk. Help much appreciated!

Thanks!

0 Karma

lpolo
Motivator
0 Karma

lpolo
Motivator

I am facing the same issue...

0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

To retrieve more than 100 results, you can set the limit higher in the API request using the count argument. For the PHP SDK, you can pass in the count parameter to the getResults() function. To page through the result set, you can use both the offset and count GET arguments to the API.

To make sure that these are being properly passed by the SDK, you should watch what's written to splunkd_access.log and verify that the GET arguments are in the requested URLs.

Get Updates on the Splunk Community!

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...

Enterprise Security Content Update (ESCU) | New Releases

In October, the Splunk Threat Research Team had one release of new security content via the Enterprise ...