Splunk Search

How to retrieve more than 100 record in searchmanager

chrismok
Path Finder

Currently, the dashboard is build in HTML dashboard with javascript, but I found that the searchmanager is only return not more than 100 rows in js. May I know how to control the return no.

 var r = searchmanager1.data('results');
 searchmanager1.on('search:done', function(state,job) {

    console.log('total:' + state.content.resultCount); //Return 270 or more

});

r.on('data', function(results) {
        console.log('length:' + r.data().rows.length); // Only return 100
    });
Tags (1)

AndrewEvelopers
Explorer

Uh I've found it on some github code:

searchManager.data('results', {count: 0, output_mode: 'json'}).on('data', parseData);

bhawkins1
Communicator

In my case I had to use 'json_rows', like so:

searchManager.data('results', {count: 0, output_mode: 'json_rows'}).on('data', parseData);

akath_splunk
Splunk Employee
Splunk Employee

Thank you! This answer saved me a lot of time 🙂

0 Karma

sibrahim
Engager

I signed in just so I could say thank you, you have saved me a whole lot of stress.

0 Karma

AndrewEvelopers
Explorer

Same problem. No ideas?

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...