Splunk Search

Is there a limit to the number of rows returned by a search using the Java SDK ?

ssubbiah001
Explorer

I'm new to splunk and am facing an issue when doing a search using Java SDK. I have a search that should return around 300 rows but only 200 are returned and then an exception is thrown.
[Fatal Error] :-1:-1: Premature end of file.
com.splunk.HttpException: HTTP 401

When I run the same search in splunk UI, I get all the 300 + rows. Below is the code snippet that I use. Is there any configuration that I should change or is there anything wrong with this code? I also see the following error in logs.

Any help to help me resolve this issue is greatly appreciated.

  service.login();
  Job job = service.getJobs().create(splunkSearch.toString());
  while (!job.isDone()) {
    Thread.sleep(Integer.parseInt(sleepTime));
  }
  JobResultsArgs resultsArgs = new JobResultsArgs();
  resultsArgs.setOutputMode(JobResultsArgs.OutputMode.JSON);

  InputStream results = job.getResults(resultsArgs);
  ResultsReaderJson resultsReader = new ResultsReaderJson(results);

 HashMap<String, String> event;

  while ((event = resultsReader.getNextEvent()) != null) {
    System.out.println("***** Start of a row *****");
    for (String key : event.keySet()) {         

      System.out.println("       "+key + ":  " + event.get(key));
    }
  }
  resultsReader.close();
Tags (4)
0 Karma
1 Solution

ssubbiah001
Explorer

Thanks for the response. In my case I figured out that the api restricts the results to the first 100. and I need to set the count explicitly to 0 to return all results. Once I changed the code to set the count as follows before getting results, I could see all the rows.

   resultsArgs.setCount(0);
   InputStream results = job.getResults(resultsArgs);

View solution in original post

ssubbiah001
Explorer

Thanks for the response. In my case I figured out that the api restricts the results to the first 100. and I need to set the count explicitly to 0 to return all results. Once I changed the code to set the count as follows before getting results, I could see all the rows.

   resultsArgs.setCount(0);
   InputStream results = job.getResults(resultsArgs);

thomrs
Communicator

I had a similar issue with the python SDK. I ended up paginating though the results to get things working. This becomes even more necessary when your search returns more data.

Wish I could help more, Im an ex Java/Scala developer, but my new team is in love with python so thats where I live now.

http://dev.splunk.com/view/java-sdk/SP-CAAAEPZ#paginating

0 Karma
Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...