What conf files must I update to change the 50000 limit for external scripts?

[andrewtrobec]

Hello,

I currently have an external python script that is called by my search to manipulate data. Everything works except I've noticed that the Statistics tab is limiting the number of results to 50000. I've found a number of threads that address limits of 50000, but none that will help to raise the upper limit for script calls.

I've tried to add a [default] stanza to my local commands.conf where i set maxinputs = 0, but that has had no effect.

Could someone help me understand which conf files I need to update?

Thank you!

Andrew

[493669 · Accepted solution]

Hi @andrewtrobec,
Have you tried to to add this in limits.conf present at $SPLUNK_HOME/etc/system/local/

[searchresults] 
maxresultrows = 100000
[stats]
maxresultrows = 100000
[top]
maxresultrows = 100000

[andrewtrobec]

This did the trick!

Also, for reference I had to update commands.conf in $SPLUNK_HOME/etc/apps/<app_name>/local to:

[default]
maxinputs = 0
maxresultrows = 100000

Regards,

Andrew