Monitoring Splunk

How do I extract events for one year for a single host beyond the 10000 results limit?

MRx2473
Observer

How do I extract events for one year for a single host beyond the 10000 results limit?
Older Build 4.0.8, build 73243.

Tags (1)
0 Karma

ShaneNewman
Motivator

Use the outputcsv command. This will write out all of the events to a *.csv file in Splunk/var/run.

0 Karma

ShaneNewman
Motivator

If outputcsv still limits to 10,000, then use outputlookup.

0 Karma

linu1988
Champion

yeah 10000 is a limit set to control performance not a limitation as far as i think.

0 Karma

aholzer
Motivator

Google limits.conf. Look at the documentation and find which attribute sets the limit of results (maxResults or something like that). Change it to what you want your limit to be. Restart your instance.

Hope this helps.

Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcment

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...