Search event count limited from REST API but not UI search

[tabchb]

Hi,

I'm running a search as follows via the Splunk Web UI ie. search index="xxxx" sourcetype="some_gateway" for a given day(24hrs) and it returns say >500,000 results, but the same search queried from the REST API stops early at 173,889 results every time. How can I increase this number and why is the UI query different?

Thanks

[karan1337]

Events are different from results. I was also hitting a similar limit of 500,000 events in my REST API. Try appending | table * to your search and check the number of events you are getting.

[santos_solorzan]

THIS WORKED FOR ME - thanks so much karan1337 🙂

[steveyz]

Are you trying to export the events as a csv file?

[steveyz]

The search should definitely not be stopping. You could check search.log in the job's dispatch directory to see if there's message indicating why the job stopped.

[tabchb]

No, trying to extract directly via the Http REST API. Not to worry I probably just need to limit the scope of my search to lower time intervals - say 1 hour at time.

[tabchb]

Nope new limit at 400,000

[tabchb]

adding the magic status_buckets = 300 parameter to the search create command seems to have allowed me to bust through the limit