Sharing the answer I found after working with the Splunk team to dig this out. There's no call to the python SDK so that doesn't appear to impact anything. Turns out that the answer is maxresultrows setting in limits.conf. This limits the search to 50,000. However, there's a second limitation underneath the commands.conf file that is required as well. commands.conf [scrub] maxinputs = integer From documentation: * Maximum number of events that can be passed to the command for each invocation. * This limit cannot exceed the value of maxresultrows in limits.conf. * 0 for no limit. * Defaults to 50000. The smallest of the values of maxresultrows and maxinputs will be the value that is returned. Hopefully this saves someone a few minutes of clicking. ... View more