You might be able to achieve what you want by triggering a real time search. Since you are using the Python you know or are using the python SDK right? I would probably use the stail.py script as a starting point: http://dev.splunk.com/view/SP-CAAAEFK#stail https://github.com/splunk/splunk-sdk-python/blob/master/examples/stail.py Chris ... View more

You can get all the events, even when the result set is greater than the limits specified in the conf files. The concept is the same as specified in this splunk-answer, though the language is Java: http://splunk-base.splunk.com/answers/43907/change-default-limit-of-100-results-using-java-sdk ... View more