Splunk AppDynamics

Analytics - Search and Analyze - Download CSV - 1000 record limit?

chidex
New Member

Hi, Did you get a solution to this??

Labels (1)
0 Karma

Mohammed_Rayan
Contributor

Hi Chidi,

In 4.2  version when doing an advanced ADQL query you can add "limit 20000" to have up to 20000 items returned in a CSV export. Please find the doc link below which explains about the LIMIT clause

https://docs.appdynamics.com/display/PRO42/LIMIT+Clause

Hope this helps

Regards,

Mohammed Rayan

Nina_Wolinsky
Path Finder

Hi @Chidi.uchegbu @Mohammed.Rayan - Circling back on this thread, were you referring to the download csv record limit or the LIMIT clause in the query @Chidi.uchegbu?

In 4.5, we've expanded the analytics export capability by increasing the number of rows that can be exported to CSV to 65,000. Hope that information helps! If you were referring to the LIMIT clause in the query and not the CSV record limit, that is a separate feature and is unrelated to the recent update.  

Mikel_Osinalde_
Path Finder

Hi @Nina.Wolinsky,

And is it possible to increase this 65k limit?

Thanks,

Mikel.

0 Karma

Nina_Wolinsky
Path Finder

Hi @Mikel.Osinalde Aztiria  - No, it's not possible to increase that limit. Per our docs, "The maximum number of records exported for a non-aggregation query is 65000. Use the LIMIT clause to restrict the records to a number below the upper bound. The LIMIT clause does not return any additional records that satisfy the export selection criteria."

Here is more information on Search Analytics Data: 

https://docs.appdynamics.com/display/PRO45/Search+Analytics+Data

Let us know if you have any other questions!

Vishwanath_Nair
Explorer

Are there any plans to increase this 65K limit for exporting into CSV ?

We are monitoring internet banking applications with millions of transactions and 65K severely limits our ability to export important transaction data.

0 Karma

iamryan
Community Manager
Community Manager

Hi @Vishwanath.Nair 

I just heard back from the product team.

The following property is the max number of records returned when the query is an aggregation query. ( Elastic search puts this limit to 10000, so we can not have more than 10k records returned for aggregation query)
query.max.top.level.aggregation.level.limit=1000
For non-aggregation queries,  this is governed by the dynamic property “query.max.export.results.limit”.
and currently, this value is 65kBoth these limits on aggr and non aggr queries are configurable property for ADQL for CSV export.  ( with a hardcoded max limit of 10k on aggr query put by Elastic search)
0 Karma

Vishwanath_Nair
Explorer

Thanks for this, @Ryan.Paredez 

For non-aggregation queries, is there a max limit for the property “query.max.export.results.limit" ?

Regards,

Vish

0 Karma

iamryan
Community Manager
Community Manager

Hi @Vishwanath.Nair,

The limit is 65k

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...