Splunk Search

dbquery and outputcsv limited to 10,000 results

imarks004
Path Finder

I am trying to create a lookup file daily from data I am pulling with dbquery out of an Oracle Database. If I do the search out of the UI and set the limit=x, I get all the results back. If I do the same search piped to outputcsv, I only get 10,001 results. I am using outputcsv successfully with ldap search to output more 10,000 results, so I cannot see to figure out what is preventing this from working with dbquery.

Thank you.

0 Karma
1 Solution

araitz
Splunk Employee
Splunk Employee

I don't think there is any difference between outputcsv in one app verses another, as outputcsv is a core Splunk search command.

With regard to dbquery, what version of DB Connect are you using? If you run dbquery from the search view and set limit=20000, what happens?

View solution in original post

0 Karma

araitz
Splunk Employee
Splunk Employee

I don't think there is any difference between outputcsv in one app verses another, as outputcsv is a core Splunk search command.

With regard to dbquery, what version of DB Connect are you using? If you run dbquery from the search view and set limit=20000, what happens?

0 Karma

imarks004
Path Finder

I am running version 1.1.1. So after just playing around with this a little more, it does not seem that outputcsv is limiting this, it is more likely the table command. If I run the ouputcsv right after the dbquery with a limit=1000000 set, it does dump everything. I am trying to use table command to filter just the fields I wanted passed to the CSV. I just updated the sql query to limit the results returned back and can now skip the table command.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...