Splunk Search

Search event count limited from REST API but not UI search

tabchb
Explorer

Hi,

I'm running a search as follows via the Splunk Web UI ie. search index="xxxx" sourcetype="some_gateway" for a given day(24hrs) and it returns say >500,000 results, but the same search queried from the REST API stops early at 173,889 results every time. How can I increase this number and why is the UI query different?

Thanks

Tags (3)

karan1337
Path Finder

Events are different from results. I was also hitting a similar limit of 500,000 events in my REST API. Try appending | table * to your search and check the number of events you are getting.

santos_solorzan
Engager

THIS WORKED FOR ME - thanks so much karan1337 🙂

0 Karma

steveyz
Splunk Employee
Splunk Employee

Are you trying to export the events as a csv file?

0 Karma

steveyz
Splunk Employee
Splunk Employee

The search should definitely not be stopping. You could check search.log in the job's dispatch directory to see if there's message indicating why the job stopped.

0 Karma

tabchb
Explorer

No, trying to extract directly via the Http REST API. Not to worry I probably just need to limit the scope of my search to lower time intervals - say 1 hour at time.

0 Karma

tabchb
Explorer

Nope new limit at 400,000

0 Karma

tabchb
Explorer

adding the magic status_buckets = 300 parameter to the search create command seems to have allowed me to bust through the limit

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...