I'm running a search as follows via the Splunk Web UI ie. search index="xxxx" sourcetype="some_gateway" for a given day(24hrs) and it returns say >500,000 results, but the same search queried from the REST API stops early at 173,889 results every time. How can I increase this number and why is the UI query different?
Events are different from results. I was also hitting a similar limit of 500,000 events in my REST API. Try appending | table * to your search and check the number of events you are getting.