Splunk python API returning limited data

bekeran · ‎08-05-2021

I am currently using a python API call to retrieve data from Splunk. I am getting approximately 1 day of data when the argument passed is for 30 days or more or lower of the data shown in the Splunk console. Can someone help?

venkatasri · ‎08-05-2021

Hi @bekeran

Hope you must be using search/jobs API to query the splunk and get the results. Default is 10K , if you want to retrieve more than that set max_count to desired value. 30 days is huge for API to process depends of number of events you have in Splunk.

--

An upvote would be appreciated and Accept solution if this reply helps!

Splunk python API returning limited data

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Calling All Security Pros: Ready to Race Through Boston?

Are you a member of the Splunk Community?

Splunk python API returning limited data

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Calling All Security Pros: Ready to Race Through Boston?