Monitoring Splunk

How do I extract events for one year for a single host beyond the 10000 results limit?

MRx2473
Observer

How do I extract events for one year for a single host beyond the 10000 results limit?
Older Build 4.0.8, build 73243.

Tags (1)
0 Karma

ShaneNewman
Motivator

Use the outputcsv command. This will write out all of the events to a *.csv file in Splunk/var/run.

0 Karma

ShaneNewman
Motivator

If outputcsv still limits to 10,000, then use outputlookup.

0 Karma

linu1988
Champion

yeah 10000 is a limit set to control performance not a limitation as far as i think.

0 Karma

aholzer
Motivator

Google limits.conf. Look at the documentation and find which attribute sets the limit of results (maxResults or something like that). Change it to what you want your limit to be. Restart your instance.

Hope this helps.

Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...