Splunk Search

oneshot limit java

scott_r
New Member

If I am trying to execute the following code block and my total records is greater than 50K it limits me to the 50K so is there a modified example of this through an offset or pagination technique someone can provide that will allow me to iterate through the full result set beyond the 50k

oneshotSearchArgs.put("earliest_time", yesterday+"T05:00:00.000" );
oneshotSearchArgs.put("latest_time", today+"T05:00:00.000" );
oneshotSearchArgs.put("count", 0);
String oneshotSearchQuery = "search " + searchString;

// The search results are returned directly
InputStream results_oneshot = service.oneshotSearch(oneshotSearchQuery, oneshotSearchArgs);

// Get the search results and use the built-in XML parser to display them
ResultsReaderXml resultsReader = new ResultsReaderXml(results_oneshot);
HashMap<String, String> event;
int eventsMatched = 0;
String log = null;
ArrayList<String> list = new ArrayList<>();
while ((event = resultsReader.getNextEvent()) != null) {

}

Labels (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@scott_r 

50K is default limits of searchresults stanza. You can change it as per your requirements and try again.

 

maxresultrows = <integer>
* Configures the maximum number of events are generated by search commands
  which grow the size of your result set (such as multikv) or that create
  events. Other search commands are explicitly controlled in specific stanzas
  below.
* This limit should not exceed 50000.
* Default: 50000

 

Please check this limits.conf doc for more information.

 

searchresults

https://docs.splunk.com/Documentation/Splunk/8.2.2/Admin/Limitsconf#.5Bsearchresults.5D

Thanks
KV
▄︻̷̿┻̿═━一   :winking_face:

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...