Splunk Search

Is there a limit to the number of rows returned by a search using the Java SDK ?

ssubbiah001
Explorer

I'm new to splunk and am facing an issue when doing a search using Java SDK. I have a search that should return around 300 rows but only 200 are returned and then an exception is thrown.
[Fatal Error] :-1:-1: Premature end of file.
com.splunk.HttpException: HTTP 401

When I run the same search in splunk UI, I get all the 300 + rows. Below is the code snippet that I use. Is there any configuration that I should change or is there anything wrong with this code? I also see the following error in logs.

Any help to help me resolve this issue is greatly appreciated.

  service.login();
  Job job = service.getJobs().create(splunkSearch.toString());
  while (!job.isDone()) {
    Thread.sleep(Integer.parseInt(sleepTime));
  }
  JobResultsArgs resultsArgs = new JobResultsArgs();
  resultsArgs.setOutputMode(JobResultsArgs.OutputMode.JSON);

  InputStream results = job.getResults(resultsArgs);
  ResultsReaderJson resultsReader = new ResultsReaderJson(results);

 HashMap<String, String> event;

  while ((event = resultsReader.getNextEvent()) != null) {
    System.out.println("***** Start of a row *****");
    for (String key : event.keySet()) {         

      System.out.println("       "+key + ":  " + event.get(key));
    }
  }
  resultsReader.close();
Tags (4)
0 Karma
1 Solution

ssubbiah001
Explorer

Thanks for the response. In my case I figured out that the api restricts the results to the first 100. and I need to set the count explicitly to 0 to return all results. Once I changed the code to set the count as follows before getting results, I could see all the rows.

   resultsArgs.setCount(0);
   InputStream results = job.getResults(resultsArgs);

View solution in original post

ssubbiah001
Explorer

Thanks for the response. In my case I figured out that the api restricts the results to the first 100. and I need to set the count explicitly to 0 to return all results. Once I changed the code to set the count as follows before getting results, I could see all the rows.

   resultsArgs.setCount(0);
   InputStream results = job.getResults(resultsArgs);

thomrs
Communicator

I had a similar issue with the python SDK. I ended up paginating though the results to get things working. This becomes even more necessary when your search returns more data.

Wish I could help more, Im an ex Java/Scala developer, but my new team is in love with python so thats where I live now.

http://dev.splunk.com/view/java-sdk/SP-CAAAEPZ#paginating

0 Karma
Get Updates on the Splunk Community!

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Get Inspired! We’ve Got Validation that Your Hard Work is Paying Off

We love our Splunk Community and want you to feel inspired by all your hard work! Eric Fusilero, our VP of ...

What's New in Splunk Enterprise 9.4: Features to Power Your Digital Resilience

Hey Splunky People! We are excited to share the latest updates in Splunk Enterprise 9.4. In this release we ...