Splunk Search

How to retrieve more than 100 record in searchmanager

chrismok
Path Finder

Currently, the dashboard is build in HTML dashboard with javascript, but I found that the searchmanager is only return not more than 100 rows in js. May I know how to control the return no.

 var r = searchmanager1.data('results');
 searchmanager1.on('search:done', function(state,job) {

    console.log('total:' + state.content.resultCount); //Return 270 or more

});

r.on('data', function(results) {
        console.log('length:' + r.data().rows.length); // Only return 100
    });
Tags (1)

AndrewEvelopers
Explorer

Uh I've found it on some github code:

searchManager.data('results', {count: 0, output_mode: 'json'}).on('data', parseData);

bhawkins1
Communicator

In my case I had to use 'json_rows', like so:

searchManager.data('results', {count: 0, output_mode: 'json_rows'}).on('data', parseData);

akath_splunk
Splunk Employee
Splunk Employee

Thank you! This answer saved me a lot of time 🙂

0 Karma

sibrahim
Engager

I signed in just so I could say thank you, you have saved me a whole lot of stress.

0 Karma

AndrewEvelopers
Explorer

Same problem. No ideas?

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

Ready to make your IT operations smarter and more efficient? Discover how to automate Splunk alerts with Red ...