I need to get historical logs from splunk between a time interval more specifically between two dates. When I do not provide a filter explicitly in my UI, I need an appropriate filter added to my backend API query which should fetch all logs between these dates. Currently I use the filter: index=_*. This works fine for real time log ingestion but in case of historical data ingestion, my logs always show the line: "500000 logs cumulated". Is there a limit of 500000 by default. Also is this the correct filter because I also tried with filter : _* and it showed a different number. Also even if there is a limit of 500000, when I cross-checked in the dashboard for a particular time range it had fewer that 500000 events, still my logs showed 500000 logs cumulated. It would be really helpful If you could provide an appropriate answer for my query. Cheers!
... View more
