Getting Data In

REST API: Why am I hitting a limit of 100 exported results?



I am trying to get some results out of Splunk using the REST API, I have the following in my script:

uri = "/services/search/jobs/" + str(sid) + "/results"
data = urllib.urlencode({"count":"0", "output_mode":"csv"})
response, content = h.request(base_url + uri, "get", data)

However, it is only downloading 100 results (101 rows including header).

I'm probably overlooking something as I've only started really using the interface. Any thoughts, on why I'm still getting the default number of results.



0 Karma

Path Finder

If I recall the splunk only send the first page by default. I had a similar issue using the SDK a while back, I collect the rest of the pages programmatically in that case.

Adding count like you did is the only way I know about using pure REST.

0 Karma


Just come across this blog article:

At the moment I have appended my URI with ?output_mode=json&count=0, which seems to work.

Still, I am curious to know what was wrong in the first place, unless this is the correct method, and I have misread the documentation.

Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...