Security
Highlighted

What setting can I change for a role to give them larger export capabilities?

Contributor

I have a user whose search export results are capping at 10Mb ... But with the admin role I can export well beyond that. Anyone know the specific capability that controls this?

Thank you ... Splunk 6.6.3

Highlighted

Re: What setting can I change for a role to give them larger export capabilities?

Contributor

A little more info ... the user is running a search that returns > 700,000 events ... and they're piping to 'reverse' ... If I remove 'reverse' from the mix, the export works. If I don't, then yes, the export writes around 10-12Mb and then redirects you to a page telling you that the search couldn't be found.

I've asked them to not use reverse for such a large dataset.

0 Karma
Highlighted

Re: What setting can I change for a role to give them larger export capabilities?

Contributor

Per Splunk official documentation, REST or SDK should be use when exporting large amount of data.
Perhaps, you could give it a shot with an email report if you don`t want to play with REST or SDK

http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Search/Exportsearchresults

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.