dbquery and outputcsv limited to 10,000 results

[imarks004]

I am trying to create a lookup file daily from data I am pulling with dbquery out of an Oracle Database. If I do the search out of the UI and set the limit=x, I get all the results back. If I do the same search piped to outputcsv, I only get 10,001 results. I am using outputcsv successfully with ldap search to output more 10,000 results, so I cannot see to figure out what is preventing this from working with dbquery.

Thank you.

[araitz · Accepted solution]

I don't think there is any difference between outputcsv in one app verses another, as outputcsv is a core Splunk search command.

With regard to dbquery, what version of DB Connect are you using? If you run dbquery from the search view and set limit=20000, what happens?

[imarks004]

I am running version 1.1.1. So after just playing around with this a little more, it does not seem that outputcsv is limiting this, it is more likely the table command. If I run the ouputcsv right after the dbquery with a limit=1000000 set, it does dump everything. I am trying to use table command to filter just the fields I wanted passed to the CSV. I just updated the sql query to limit the results returned back and can now skip the table command.