REST API: Why am I hitting a limit of 100 exported results?

[MHibbin]

Hi,

I am trying to get some results out of Splunk using the REST API, I have the following in my script:

uri = "/services/search/jobs/" + str(sid) + "/results"
data = urllib.urlencode({"count":"0", "output_mode":"csv"})
response, content = h.request(base_url + uri, "get", data)

However, it is only downloading 100 results (101 rows including header).

I'm probably overlooking something as I've only started really using the interface. Any thoughts, on why I'm still getting the default number of results.

Thanks,

MHibbin

[trsavela]

If I recall the splunk only send the first page by default. I had a similar issue using the SDK a while back, I collect the rest of the pages programmatically in that case.

Adding count like you did is the only way I know about using pure REST.

[MHibbin]

Just come across this blog article:

http://blogs.splunk.com/2011/08/02/splunk-rest-api-is-easy-to-use/

At the moment I have appended my URI with ?output_mode=json&count=0, which seems to work.

Still, I am curious to know what was wrong in the first place, unless this is the correct method, and I have misread the documentation.