Splunk Search

Export results from KV lookup file in Lookup editor?

smanojkumar
Communicator

Hi There,

   I would like to export the results of kv lookup file in a lookup editor, but the results after exporting is only 50k records, even the original results is 80k records, How to download the entire results in a single file?

Thanks!

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @smanojkumar,

are you trying to export rows from a KV Store lookup using the inputlookup command or the Lookup Editor App?

Inputllokup has the limit of 50,000 results, but the export from the Lookup Editor shouldn't have this limit.

Ciao.

Giuseppe

0 Karma

smanojkumar
Communicator

I'm trying to use lookup Editor app.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @smanojkumar,

at first see if the solution from @woodcock solves your requirement https://community.splunk.com/t5/Splunk-Search/How-can-I-escape-the-50K-subsearch-limit-while-linking...

otherwise, you could modify limits.conf:

[searchresults]
maxresultrows = 100000
[stats]
maxresultrows = 100000
[top]
maxresultrows = 100000

Ciao.

Giuseppe

0 Karma

smanojkumar
Communicator
Actually, i'm having same configuration in test environment but the lookup editor is working fine, but it is not working in dev environment, any other things or ways to increase the export records count.
0 Karma

smanojkumar
Communicator

Hi @gcusello ,

  I'm curious to know about this,

 

Thanks!

0 Karma

smanojkumar
Communicator

We need to modify in all these 3 places in limits.config file? [searchresults] maxresultrows = 100000 [stats] maxresultrows = 100000 [top] maxresultrows = 100000

0 Karma

smanojkumar
Communicator

Hi @gcusello ,

  We are having same configuration in test environment, but it's working fine, not in dev environment. Any other ways are there @gcusello ?

1. test environment

smanojkumar_0-1677569780162.png

2. Dev environment

smanojkumar_1-1677569806261.png

 

0 Karma

smanojkumar
Communicator

Hi @gcusello ,

   Any other way other than this.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @smanojkumar,

yes, I used 100000 in my example, but if you have less rown, you can use a minor number.

Ciao.

Giuseppe

0 Karma

smanojkumar
Communicator

Hi @gcusello ,

   I had changed those limits to 500000, even I can't export more than 50k rows.

 

Thanks.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

Happy CX Day, Splunk Community!

Happy CX Day, Splunk Community! CX stands for Customer Experience, and today, October 3rd, is CX Day — a ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...