Splunk Search

Exporting more than 50k rows in lookup editor app?

smanojkumar
Contributor

Hi There!

   I would like to export more than 50k rows in lookup editor app of the results of kv store lookup file, 

   I tried even changing the limits.config file, but it is not working fine,

[searchresults]
maxresultrows = 500000
[stats]
maxresultrows = 500000
[top]
maxresultrows = 500000

Can anyone say about the solution for this?

 

Thanks in Advance!

Labels (1)
0 Karma

shivanshu1593
Builder

Hello @smanojkumar ,

Lookups can have millions of results, especially the KVStore lookup. Looks like the SPL that you wrote, whose' results you're trying to output to the lookup is truncating your results. Can be caused either by using the sort command or append, join or even subsearches. Could you share your SPL, masking sensitive information in it, so that we could try to identify the problem.

Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
0 Karma

smanojkumar
Contributor

We are having the same query and configuration in dev and prod environment, where us in dev it is working fine, we can export more than 50k records but not in prod environment, since we are having same query in prod environment as well.
Any other things that restrict the export more than 50k records?

Any other reason which can cause this issue.

I would like to know, Is that something related to licensing, also I can see version in prod and dev are same.

 

Thanks in Advance!

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...