Getting Data In

Increasing number of events returned in REST api in perl script

shahhe
Explorer

Folks,

I wrote perl script to run search on remote splunk server. By default the search only returns first 100 events. How can I increase the limit without changing configuration on the server?

Is tried to use max_count but it does not have any effect:

my $response = $browser->post( $url, [ 'search' => $searchQuery, 'max_count' => 10000 ])

Thanks.

Tags (3)
1 Solution

Ayn
Legend

What URL are you posting to? By default only 100 results are returned unless you specify "count" as a parameter in the URL, like this:

$url = "https://${splunkserver}:8089/services/search/jobs/${yourjobid}/results?count=0"

View solution in original post

Ayn
Legend

What URL are you posting to? By default only 100 results are returned unless you specify "count" as a parameter in the URL, like this:

$url = "https://${splunkserver}:8089/services/search/jobs/${yourjobid}/results?count=0"

Ayn
Legend

Great! Could you please mark the question as answered as it will pop up as unanswered on the site otherwise. Thanks.

0 Karma

shahhe
Explorer

Thank you. That fixed the problem.

0 Karma

shahhe
Explorer

If I use outputcsv in searhcQuery then it return all rows (more than 10000). It seems that splunk ignores the max_count value.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...