Export results from KV lookup file in Lookup editor?

[smanojkumar]

Hi There,

   I would like to export the results of kv lookup file in a lookup editor, but the results after exporting is only 50k records, even the original results is 80k records, How to download the entire results in a single file?

Thanks!

[gcusello]

Hi @smanojkumar,

are you trying to export rows from a KV Store lookup using the inputlookup command or the Lookup Editor App?

Inputllokup has the limit of 50,000 results, but the export from the Lookup Editor shouldn't have this limit.

Ciao.

Giuseppe

[smanojkumar]

I'm trying to use lookup Editor app.

[gcusello]

Hi @smanojkumar,

at first see if the solution from @woodcock solves your requirement https://community.splunk.com/t5/Splunk-Search/How-can-I-escape-the-50K-subsearch-limit-while-linking...

otherwise, you could modify limits.conf:

[searchresults]
maxresultrows = 100000
[stats]
maxresultrows = 100000
[top]
maxresultrows = 100000

Ciao.

Giuseppe

[smanojkumar]

Actually, i'm having same configuration in test environment but the lookup editor is working fine, but it is not working in dev environment, any other things or ways to increase the export records count.

[smanojkumar]

Hi @gcusello ,

  I'm curious to know about this,

Thanks!

[smanojkumar]

We need to modify in all these 3 places in limits.config file? [searchresults] maxresultrows = 100000 [stats] maxresultrows = 100000 [top] maxresultrows = 100000

[smanojkumar]

Hi @gcusello ,

  We are having same configuration in test environment, but it's working fine, not in dev environment. Any other ways are there @gcusello ?

1. test environment

2. Dev environment

[smanojkumar]

Hi @gcusello ,

   Any other way other than this.

[gcusello]

Hi @smanojkumar,

yes, I used 100000 in my example, but if you have less rown, you can use a minor number.

Ciao.

Giuseppe

[smanojkumar]

Hi @gcusello ,

   I had changed those limits to 500000, even I can't export more than 50k rows.

Thanks.