Even though that seems like an old question let me give you my 2 cents since I encountered the same problem.
Let me start by clarifying that this question is not about the maxresultsrows that is set by default to 50k, the op is already paginating through the results and he is getting them in chunks of 50k.
The problem here is another limit of 500k. (notice the extra 0)
max_count = <integer> * The number of events that can be accessible in any given status bucket (when status_buckets = 0). * The last accessible event in a call that takes a base and count. * Note: This value does not reflect the number of events displayed in the UI after the search is evaluated or computed. * Default: 500000
You have to change that limit.
This is set in limits.conf - here is the documentation from limits.conf.spec
[restapi] maxresultrows = <integer> * Maximum result rows to be returned by /events or /results getters from REST API. * Defaults to 50000.
Also answered on Limited results when running searches via REST API
Create a limits.conf file in $SPLUNK_HOME/etc/system/local. Change the value and then restart Splunk to have the new value take effect.
No it is not set to 500k. And i am already paginating through results. Still my upper cap remains to be 500k. When i inspect the job created by the API hit on the GUI it also shows the ResultCount to be 500k. But still when i search using the same query on the SPLUNK GUI it returns me 800k results.