Splunk Search

Exporting more than 50k rows in lookup editor app?

smanojkumar
Contributor

Hi There!

   I would like to export more than 50k rows in lookup editor app of the results of kv store lookup file, 

   I tried even changing the limits.config file, but it is not working fine,

[searchresults]
maxresultrows = 500000
[stats]
maxresultrows = 500000
[top]
maxresultrows = 500000

Can anyone say about the solution for this?

 

Thanks in Advance!

Labels (1)
0 Karma

shivanshu1593
Builder

Hello @smanojkumar ,

Lookups can have millions of results, especially the KVStore lookup. Looks like the SPL that you wrote, whose' results you're trying to output to the lookup is truncating your results. Can be caused either by using the sort command or append, join or even subsearches. Could you share your SPL, masking sensitive information in it, so that we could try to identify the problem.

Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
0 Karma

smanojkumar
Contributor

We are having the same query and configuration in dev and prod environment, where us in dev it is working fine, we can export more than 50k records but not in prod environment, since we are having same query in prod environment as well.
Any other things that restrict the export more than 50k records?

Any other reason which can cause this issue.

I would like to know, Is that something related to licensing, also I can see version in prod and dev are same.

 

Thanks in Advance!

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...