What setting can I change for a role to give them larger export capabilities?

[pkeller]

I have a user whose search export results are capping at 10Mb ... But with the admin role I can export well beyond that. Anyone know the specific capability that controls this?

Thank you ... Splunk 6.6.3

[valiquet]

Per Splunk official documentation, REST or SDK should be use when exporting large amount of data.
Perhaps, you could give it a shot with an email report if you don`t want to play with REST or SDK

http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Search/Exportsearchresults

[pkeller]

A little more info ... the user is running a search that returns > 700,000 events ... and they're piping to 'reverse' ... If I remove 'reverse' from the mix, the export works. If I don't, then yes, the export writes around 10-12Mb and then redirects you to a page telling you that the search couldn't be found.

I've asked them to not use reverse for such a large dataset.