How do I find out Splunk API query row count?

Splunkster45 · ‎10-10-2018

I am using Python API call to get Splunk data. I was running to a limit where I was hitting a limit of 50k. I saw this post that talked about making multiple calls to iterate through 50k records at a time. My question is how do I know when to stop? Is there a way I get to figure out exactly how many records it has and then I can make the right number of loops?

Thanks

valiquet · ‎10-28-2018

You can use the stats or timechart commands

|timechart count as nbevent span=60m by _time | where nbevent>50000

Decrease span=60m until you drop under 50000

How do I find out Splunk API query row count?

Thanks for the Memories! Splunk University, .conf25, and our Community

Data Persistence in the OpenTelemetry Collector

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever

Are you a member of the Splunk Community?

How do I find out Splunk API query row count?

Thanks for the Memories! Splunk University, .conf25, and our Community

Data Persistence in the OpenTelemetry Collector

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever