Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Other Using Splunk
- :
- Reporting
- :
- Output Results to Lookup Truncating Results
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello, Hoping for some guidance.
I have a scheduled report that has been running weekly for several months now without any issues. I am outputting the results to a lookup file and replacing the results with each run.
As of this week the lookup no longer contains all of the results, it is limited to 175,000 results.
If I run the report manually as a search and export it, I get the correct results 181,113
I haven't been able to find any info related to limits on lookups. Is there a conf file config related to max results or max file size?
The latest file was 36.1 MB.
Any help would be greatly appreciated!
Thank you.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Don’t use alert action to lookup. Use the outputlookup command at the end of your SPL. That should help.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Don’t use alert action to lookup. Use the outputlookup command at the end of your SPL. That should help.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi colleagues,
i have faced the same issue and just curious where actually the limitation defined (for alert action to lookup )
KR, Lis
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
damn! you are awsome..
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Worked perfectly, funny how you caught up over thinking and missing the obvious!
Thank you for the assistance!
Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA
.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...
A Season of Skills: New Splunk Courses to Light Up Your Learning Journey
