Splunk Search

dbquery and outputcsv limited to 10,000 results

imarks004
Path Finder

I am trying to create a lookup file daily from data I am pulling with dbquery out of an Oracle Database. If I do the search out of the UI and set the limit=x, I get all the results back. If I do the same search piped to outputcsv, I only get 10,001 results. I am using outputcsv successfully with ldap search to output more 10,000 results, so I cannot see to figure out what is preventing this from working with dbquery.

Thank you.

0 Karma
1 Solution

araitz
Splunk Employee
Splunk Employee

I don't think there is any difference between outputcsv in one app verses another, as outputcsv is a core Splunk search command.

With regard to dbquery, what version of DB Connect are you using? If you run dbquery from the search view and set limit=20000, what happens?

View solution in original post

0 Karma

araitz
Splunk Employee
Splunk Employee

I don't think there is any difference between outputcsv in one app verses another, as outputcsv is a core Splunk search command.

With regard to dbquery, what version of DB Connect are you using? If you run dbquery from the search view and set limit=20000, what happens?

0 Karma

imarks004
Path Finder

I am running version 1.1.1. So after just playing around with this a little more, it does not seem that outputcsv is limiting this, it is more likely the table command. If I run the ouputcsv right after the dbquery with a limit=1000000 set, it does dump everything. I am trying to use table command to filter just the fields I wanted passed to the CSV. I just updated the sql query to limit the results returned back and can now skip the table command.

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...