Any update on this topic? I also have set mine higher and the max_size_kb remains at 500. ... View more

I imagine that the "automation" part has something to do with an action such as outputlookup?  I am curious about how reload interacts, too. For mere automation, you can simply include the entire search in your API call.  ... View more

Workaround below: Use endpoint /servicesNS/nobody/<app_name>/admin/localapps/_reload  with GET request ... View more

  So you'll need to open file "etc/apps/Splunk_SA_CIM/bin/modaction_adhoc_rest_handler.py". And add to line 561. 'preview': 'false',   Basically you'll want the code block to look like this: args = { 'output_mode': 'json', # CIM-944: adhoc_search_level essential to proper field extraction 'adhoc_search_level': 'verbose', 'preview': 'false', 'search': search }  Restart afterwards - This worked from me, kudos to @ebond_splunk  ... View more

Can you explain this a bit better? I'm trying to run that query you have, but its just not working? ... View more