Hi. I am running a Splunk query from the CLI and would like to export the results as rawdata to a file. When I specify a value in maxout, it honors that number and exports the correct number of events. However, I want all of the events - unlimited. So I set maxout to 0, per the documentation. When I do this, it exports nothing. The search just sits there forever, exporting nothing. Even if it's a quick and simple search.
Here is my query:
splunk search "index=ldap earliest=01/24/2022:00:00:01 latest=01/25/2022:23:59:00" -output rawdata -maxout 0 > /mnt/splunk-backups/test/ldap-raw-test.log
I want all events to be outputted as rawdata to the specified file.
Am I missing something?
We are running Splunk Enterprise 8.1.4.
Thanks in advance!
