I am using Python API call to get Splunk data. I was running to a limit where I was hitting a limit of 50k. I saw this post that talked about making multiple calls to iterate through 50k records at a time. My question is how do I know when to stop? Is there a way I get to figure out exactly how many records it has and then I can make the right number of loops?
Thanks
You can use the stats or timechart commands
|timechart count as nbevent span=60m by _time | where nbevent>50000
Decrease span=60m until you drop under 50000