outputlookup is limited to 10,000 results

[jambajuice]

I need to create an outputlookup file with more than 10,000 results. I've looked through the limits.conf examples and I can't find a way to increase the number of results beyond 10K.

Is this possible?

Craig

[rfiscus]

Yup, sort was killing it for me. Thanks!

[steveyz]

What is the full search? outputlookup itself does not have any results limits, and a limit of 10k would mostly be due to a sort command you may be using. (sort implicitly truncates to the first 10k output rows unless you specify limit=0 as an argument to it)

[rdownie]

sort limit=0 worked for me.
Thanks.

[steveyz]

try using fields instead of table

[jambajuice]

The search is:

sourcetype="nessus_plugins" | table nessus_id,cve_id,osvdb_id | outputlookup osvdb_cvs_lookup.csv

If I remove the outputlookup part of the search, it still maxes out at 100000 events.