Getting Data In

How to change the max line length parameter before adding a line break for exporting by CSV?

matthieu_araman
Communicator

Hello,

I'm doing such a search:

mysearch | stats dc(ip) as countip, values(ip) as valuesip | where countip > xxx | table countip,valuesip

Then either export results via the UI or scheduling and sending the csv results.

The number of returned rows is a few lines (<100)
countip max is about 6000 so the valuesip field may contain a list of 6000 ips

In the Splunk Web UI, it looks correct.
In the csv file, when I look at it in a text editor, I see the line breaks at 991 characters.
Results are not truncated, but they are on the second line and so on.

Obviously, when opening the csv file, it produces garbage ...

So I need to change the "max line length before adding a new line character when exporting by csv" parameter?

I couldn't find which setting it is.

Any idea?

Tags (4)
0 Karma

matthieu_araman
Communicator

tested on another splunk instance and doesn't seem limited this time

testcase
* | stats dc(dest_ip) as countip,values(dest_ip) | sort limit=1 - countip
have more than 8000 results
csv file is two lines
header
one 123000 length line -> good

the one with the pb has many parameters set -> still trying to find which one manage this

0 Karma

fdi01
Motivator

in limits.conf file, try like this :

 [restapi]
     # maximum result rows to be returned by /events or /results getters from REST API  
     maxresultrows = 60000

Increase that value to the desired maximum number of events,
This configuration option should affect the number of results exported for a table.

0 Karma

matthieu_araman
Communicator

Hello,

this problem is not row depending as it can occurs with only one row.
As noted initially, I've very few raws for this search but can have a list of several thousands ip as a value.

For another report, I've already upped maxresults, maresultrows to 1M and the maresults in a csv atteched to email to 50k -> I don't think this is the limiting factor.

as line are wrapped to 991 characters, there may be a setting around 1000 ?
I've looked as 1000 values in limits.conf without success but I may have missed the good one.

0 Karma

vinitatsky
Communicator

alt textWhile exporting the results - select 'Number of Results' to 'Unlimited'.alt text

Hope it helps.

0 Karma

matthieu_araman
Communicator

already doing this, I think it just adjust number of returned rows
I've got other reports with more than 10k rows running ok (already upped this limit to 50k)
I'm only doing the export via ui for debugging, I will automatically send as csv by email

0 Karma

vinitatsky
Communicator

In limits.conf - there is one configuration value i.e.
http://docs.splunk.com/Documentation/Splunk/6.2.3/Admin/Limitsconf

[associate]
maxvaluesize =
* Maximum length of a single value to consider.
* Defaults to 1000.

Can you check this value and give it a try?

0 Karma

matthieu_araman
Communicator

Will try.

But the cell value is not really truncated but spread over multiples rows in the csv...

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...