Splunk Search

Overcoming subsearch truncation

yepyepyayyooo
New Member

I do not have any admin privilege in my Splunk instance and cannot change any configuration.

Need to search an index for any value matching what's in a lookup file. The problem is the file contains 130K records and I get a maxout truncation at 10K. How do I overcome this?

If you plan to tell me to split it up into 10K files, please don't.

index="bro"
   [ inputlookup bad_domains
   | fields domain ]
|stats values(domain) by _time    
Labels (1)
Tags (1)
0 Karma
1 Solution

to4kawa
Ultra Champion
| inputlookup bad_domains
| eval flag="csv"
| append [search  index="bro"
| stats values(domain) as domain by _time
| eval flag="index"]
| stats dc(flag) as flag values(_time) as _time by domain
| where flag > 1
| table _time domain

search huge one first.

View solution in original post

0 Karma

to4kawa
Ultra Champion
| inputlookup bad_domains
| eval flag="csv"
| append [search  index="bro"
| stats values(domain) as domain by _time
| eval flag="index"]
| stats dc(flag) as flag values(_time) as _time by domain
| where flag > 1
| table _time domain

search huge one first.

0 Karma

yepyepyayyooo
New Member

Thanks to4kawa. I don't follow though. How do I fix the where comparison?

0 Karma

to4kawa
Ultra Champion

why do you fix this?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...