Getting Data In

External Lookup 100 row limit

ConsoleBotTryPC
Path Finder

Hi,

I am using an external lookup to basically run a Python script which runs an API call to return the results using a csv.dictwriter to the sys.stdout.

There are around 1250 rows being written to the console
But only the first 100 rows are being shown in Splunk.

How can I disable this 100-row limit on external lookups?

 

Thank you and have a nice day,

 

Best,

Labels (1)
0 Karma

ConsoleBotTryPC
Path Finder
0 Karma

ConsoleBotTryPC
Path Finder

Also had found about the keyword to be added in transforations.conf

max_matches

but this has an upper limit of 1000. I need more...

 

Refer: https://docs.splunk.com/Documentation/Splunk/latest/Admin/Transformsconf#Lookup_tables

0 Karma

PickleRick
SplunkTrust
SplunkTrust

You can't have more. You might be able to "walk around" this limitation by writing custom command - it's bound by other rules than scripted lookup.

0 Karma
Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

[Puzzles] Solve, Learn, Repeat: Unmerging HTML Tables

[Puzzles] Solve, Learn, Repeat: Unmerging HTML TablesFor a previous puzzle, I needed some sample data, and ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...