Monitoring Splunk

How do I extract events for one year for a single host beyond the 10000 results limit?

MRx2473
New Member

How do I extract events for one year for a single host beyond the 10000 results limit?
Older Build 4.0.8, build 73243.

Tags (1)
0 Karma

ShaneNewman
Motivator

Use the outputcsv command. This will write out all of the events to a *.csv file in Splunk/var/run.

0 Karma

ShaneNewman
Motivator

If outputcsv still limits to 10,000, then use outputlookup.

0 Karma

linu1988
Champion

yeah 10000 is a limit set to control performance not a limitation as far as i think.

0 Karma

aholzer
Motivator

Google limits.conf. Look at the documentation and find which attribute sets the limit of results (maxResults or something like that). Change it to what you want your limit to be. Restart your instance.

Hope this helps.

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...