Limits of events returned

[AleCanzo]

Hi guys, is there a limit of the number's events returned  in splunk? 
I'm trying to run a query with inputlookup, but i see only 50_000 results, while my lookup has more results.
The limit.conf file seems to be useless, any suggestions?
Thanks 🙂

[PickleRick]

Depends how you're using the inputlookup. A "nice" number suggests you're hitting one of splunk's limits which I suspect comes from using inputlookup within a subsearch.

You can use inputlookup with append=t but not every use case can be expressed this way.

[ITWhisperer]

There is a limit on subsearches - how are you using inputlookup in your full search?

[livehybrid]

Hi @AleCanzo 

As far as I know inputlookup has a default max output of 1000000000 rows (see https://help.splunk.com/en/splunk-enterprise/spl-search-reference/9.3/search-commands/inputlookup )

Im certainly able to use inputlookup with a lookup which has over 600,000 rows without issue or modification to limits.conf

Are you using any other commands in your search which could be limiting? e.g. rare / table / stats / top

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[AleCanzo]

Hi @livehybrid, 
Let me explain better. I have SOAR and Enterprise on Cloud. I'm trying to get, via "run query" in a playbook, some resultst from SIEM to SOAR. The query is a simple | inputlookup command on a csv. However i don't get all the results. Where's the problem? Splunk Cloud? the request from SOAR?
Thanks 🙂

[gcusello]

Hi @AleCanzo ,

if it is a custom csv lookup, try to use a KV-store that shouldn't have this limit.

Ciao.

Giuseppe