Export limit in 5.x

Path Finder

I have a 2 search heads distributed to the same servers. I run a search: index=X sourcetype=Y | table A B C

The search completes with 317,000 results.

On 4.3.4 when I do an "unlimited" export (to CSV) I get all 317,000 results
5.0.2 only 50,000 results in the "unlimited" export.

Is there a new limit to "unlimited"?

Tags (1)

Splunk Employee
Splunk Employee

The configuration option that should affect the number of results exported for a table is this:

maxresultrows = 50000

Increase that value to the desired maximum number of events. It doesn't look as if this limit has changed between version 4.3.4 and 5.x, so maybe you had configured the value in /default and the upgrade overwrote the changes. Be sure to save your configuration changes in a /local folder. Don't forget to restart Splunk after making the change.

As a side note, if you export the events without "| table", you should receive a full list without the option set.


Is there a bug in this configuration?

Set maxresultrows = 100, exported results as csv file, set to unlimited, gave all results.

Is this the wrong configuration to look at when limiting the returned results from UI export button?

0 Karma

Path Finder

@Ron Naken , is it possible for users to override maxresultrows in Enterprise version?

0 Karma


version 6.0.5

0 Karma
Get Updates on the Splunk Community!

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...