Splunk Search

How to increase number of events in format?

klim
Path Finder

I have a lookup table that I want to use in a search. So I load the lookup table and use format. However I noticed there is a limit to 50,000 events in the format's result. What config allows me to increase that or convert a column of values into a single string?

| inputlookup test.csv 
| table count
| format

The lookup has 50,001 values in it but format only goes up to 50,000. 

Labels (1)
0 Karma

klim
Path Finder

I figured out a different method to get the data into one row using mvcombine.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @klim,

could you better describe what you want to reach using format?

in other words, what's the desidered output?

Ciao.

Giuseppe

0 Karma

klim
Path Finder

@gcusello  I want to use the events in the lookup table to be used in an api request. 

Using format allowed me to get all the events into one row and then I can format it however I want.

I was trying to use foreach to loop through the values and concatenate them but I have not been able to figure that out as well.

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...