Getting Data In

Increasing number of events returned in REST api in perl script

shahhe
Explorer

Folks,

I wrote perl script to run search on remote splunk server. By default the search only returns first 100 events. How can I increase the limit without changing configuration on the server?

Is tried to use max_count but it does not have any effect:

my $response = $browser->post( $url, [ 'search' => $searchQuery, 'max_count' => 10000 ])

Thanks.

Tags (3)
1 Solution

Ayn
Legend

What URL are you posting to? By default only 100 results are returned unless you specify "count" as a parameter in the URL, like this:

$url = "https://${splunkserver}:8089/services/search/jobs/${yourjobid}/results?count=0"

View solution in original post

Ayn
Legend

What URL are you posting to? By default only 100 results are returned unless you specify "count" as a parameter in the URL, like this:

$url = "https://${splunkserver}:8089/services/search/jobs/${yourjobid}/results?count=0"

Ayn
Legend

Great! Could you please mark the question as answered as it will pop up as unanswered on the site otherwise. Thanks.

0 Karma

shahhe
Explorer

Thank you. That fixed the problem.

0 Karma

shahhe
Explorer

If I use outputcsv in searhcQuery then it return all rows (more than 10000). It seems that splunk ignores the max_count value.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...