Powershell Resource kit Search has Max 100 results

[jkcouch]

I have been playing around with the powershell resource kit, trying to use it as a searching interface to use with automation. I am trying to get results in exess of 100 events. Even with the use of the -MaxReturnCount option, it only returns up to 100 (allows to decrease from 100, but not increase above). I have found several other posts on modifying this but not in the powershell resource kit.

As I look at the splunk-core .psm1 file i can see where we could edit the $PostString variable, but thought I should report this as a possible bug.

Example script:

$credential = Get-Credential
Connect-Splunk -Credential $credential –ComputerName Computername
$connection = Get-SplunkConnectionObject
$search = $Connection | Search-Splunk -Search 'source="PS_VMHost_Config" earliest=-10d@d latest=now'-MaxTime 30 -MaxReturnCount 30 -Verbose

Any assistance would be great!

[cohatch]

It seems the powershell parameter maxreturncount creates the header addition "max_count=" when it should simply add "count="

[halr9000]

Fix committed. Test please! https://github.com/splunk/splunk-reskit-powershell/archive/master.zip

[halr9000]

TY Drainy 🙂

[Drainy]

Switcharooed to an answer

[halr9000]

@cohatch, why don't you type this up as an Answer so that others can vote on it. I assume that you are talking about changing splunk-search.psm1, line 93 from "max_count" to "count", correct? Write that up as an answer, confirm that you've tested it, and I'll commit it to Github. TIA

[bsonposh]

Thanks jkcouch. I will get this fixed. I thought we added an override for this but I believe you are you correct.

[jkcouch]

cohatch - that fixed it for me too. Thanks!

[cohatch]

Any update on this? Thanks.

[jkcouch]

Thanks Brandon!