Splunk Search

outputlookup is limited to 10,000 results

jambajuice
Communicator

I need to create an outputlookup file with more than 10,000 results. I've looked through the limits.conf examples and I can't find a way to increase the number of results beyond 10K.

Is this possible?

Craig

Tags (1)

rfiscus
Path Finder

Yup, sort was killing it for me. Thanks!

steveyz
Splunk Employee
Splunk Employee

What is the full search? outputlookup itself does not have any results limits, and a limit of 10k would mostly be due to a sort command you may be using. (sort implicitly truncates to the first 10k output rows unless you specify limit=0 as an argument to it)

rdownie
Communicator

sort limit=0 worked for me.
Thanks.

0 Karma

steveyz
Splunk Employee
Splunk Employee

try using fields instead of table

0 Karma

jambajuice
Communicator

The search is:

sourcetype="nessus_plugins" | table nessus_id,cve_id,osvdb_id | outputlookup osvdb_cvs_lookup.csv

If I remove the outputlookup part of the search, it still maxes out at 100000 events.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!