service.jobs.export is your answer. export doesn't have the 50,000 row limit. Also, be sure to set preview to false.
kwargs_export = {
"earliest_time": datetime.datetime(2015, 6, 29).isoformat(),
"latest_time": datetime.datetime(2016, 4, 11).isoformat(),
"search_mode": "normal",
"preview": False
}
searchString = "search index=* | head 5"
rr = results.ResultsReader(service.jobs.export(searchString, **kwargs_export))
for result in rr:
if isinstance(result, results.Message):
# Diagnostic messages may be returned in the results
print '%s: %s' % (result.type, result.message)
elif isinstance(result, dict):
# Normal events are returned as dicts
print result
... View more