After upgrading to 5.0.3, I can only export 100 lines of csv via UI.

[the_wolverine]

Upgraded from 4.3.x to 5.0.3 this week and noticed that exporting from UI only produces 100 lines of CSV. Yes, I checked "Unlimited" and even tried checking the 10000 lines option.

Using * | outputcsv myfile.csv produces a csv file with the correct number of lines (more than 100).

[bfernandez]

It is not taking the maxout configuration that is 100 events in a search query by defafult.
Try this CLI example:

Without maxout:

./splunk search "| savedsearch name" -output csv > /data/test/export.csv

(in jobs view) | savedsearch Datos_Grupo_9 | head 100 | export add_timestamp=f add_offset=t format=csv segmentation=raw

With maxout:
./splunk search "| savedsearch name" -output csv -maxout 0 > /data/test/export.csv

(in jobs view) | savedsearch Datos_Grupo_9 | export add_timestamp=f add_offset=t format=csv segmentation=raw

[the_wolverine]

So the setting that we used in version 4.3.x did not affect EXPORT but it does in version 5.0?

[Chubbybunny]

limits.conf

  [restapi]
    # maximum result rows to be returned by /events or /results getters from REST API  
    maxresultrows = 50000

you'll need to increase that, enjoy!

(\__/)
(='.'=)
(")_(")
*shout-out to Rob C. too!

[Rob]

Thx Chubbybunny