Splunk Search

Overcoming subsearch truncation

yepyepyayyooo
New Member

I do not have any admin privilege in my Splunk instance and cannot change any configuration.

Need to search an index for any value matching what's in a lookup file. The problem is the file contains 130K records and I get a maxout truncation at 10K. How do I overcome this?

If you plan to tell me to split it up into 10K files, please don't.

index="bro"
   [ inputlookup bad_domains
   | fields domain ]
|stats values(domain) by _time    
Labels (1)
Tags (1)
0 Karma
1 Solution

to4kawa
Ultra Champion
| inputlookup bad_domains
| eval flag="csv"
| append [search  index="bro"
| stats values(domain) as domain by _time
| eval flag="index"]
| stats dc(flag) as flag values(_time) as _time by domain
| where flag > 1
| table _time domain

search huge one first.

View solution in original post

0 Karma

to4kawa
Ultra Champion
| inputlookup bad_domains
| eval flag="csv"
| append [search  index="bro"
| stats values(domain) as domain by _time
| eval flag="index"]
| stats dc(flag) as flag values(_time) as _time by domain
| where flag > 1
| table _time domain

search huge one first.

0 Karma

yepyepyayyooo
New Member

Thanks to4kawa. I don't follow though. How do I fix the where comparison?

0 Karma

to4kawa
Ultra Champion

why do you fix this?

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...