Hi, I am using the Splunk API (with Python) to pull all values of a given record from a given index. I would like to download all data on a regular basis. What strategy should I use to ensure I get all records without duplication and without missing anything? For instance, in a traditional DB world I might use a unique index value to keep track. For example I would like to run this every hour to get all records: "search index=syslog ssh* | table _raw" Should I use some 'time' condition or is there some sort of count or index I could use? Thanks ... View more

I am using the search.py script from the SDK. I have the following set : --max_count=1000000 --count=0 --output_mode=csv Yet the results always limit themselves to 100,000 lines? Why is this? Doesn't --count=0 mean send me all results? And then --max_count=1000000 means mark the job as finished at 1,000,000 events? So why do I only get 100,000 records? Always about 100,000 CORRECTION: although there are 100,000 lines, in fact there are 50,000 records! The lines are wrapped and have a CR in them hence the 100,000. Why am I hitting a limit of 50,000 records? Thanks ... View more