Security

Why are logs sometimes truncated during export from the Splunk Web UI?

New Member

After making a search on the search head, clicking on the "Export" icon on the GUI, and after waiting up to a minute for the download to start, the file I receive has a size of 32768 bytes, whereas it should have been 284050 bytes. This happens only sometimes, and for no apparent reason.

Is this a known bug? Can I do something against it?

0 Karma

Communicator

There are quite a few limitations, which could block you to get the whole data.

One of 'em is simply the fact of 50000-lines-limit on csv-exports. (even if u click on "unlimited")

0 Karma

Contributor

well, I am coming back to my older request, could you please provide more details about your search query.
One Thing which comes into my mind is the default 10000 records limit on the sort command.

New Member

I am using "Raw Events" instead of csv as the output format. Does that still apply?

0 Karma

Communicator

afaik only csv

But you can check it easily via wordcount
wc -l file

0 Karma

Contributor

could you please provide more details:
how many lines does your export contain, and does your search include a sort command?

0 Karma