Splunk Search

Exporting more than 50k rows in lookup editor app?

smanojkumar
Communicator

Hi There!

   I would like to export more than 50k rows in lookup editor app of the results of kv store lookup file, 

   I tried even changing the limits.config file, but it is not working fine,

[searchresults]
maxresultrows = 500000
[stats]
maxresultrows = 500000
[top]
maxresultrows = 500000

Can anyone say about the solution for this?

 

Thanks in Advance!

Labels (1)
0 Karma

shivanshu1593
Builder

Hello @smanojkumar ,

Lookups can have millions of results, especially the KVStore lookup. Looks like the SPL that you wrote, whose' results you're trying to output to the lookup is truncating your results. Can be caused either by using the sort command or append, join or even subsearches. Could you share your SPL, masking sensitive information in it, so that we could try to identify the problem.

Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
0 Karma

smanojkumar
Communicator

We are having the same query and configuration in dev and prod environment, where us in dev it is working fine, we can export more than 50k records but not in prod environment, since we are having same query in prod environment as well.
Any other things that restrict the export more than 50k records?

Any other reason which can cause this issue.

I would like to know, Is that something related to licensing, also I can see version in prod and dev are same.

 

Thanks in Advance!

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...