Try the following regex: Contact Dealership Name=\"(.+?)\" ... View more

You should do it on both (SH and indexers) otherwise you are going to have discrepancies. Iplocation is a streaming command and depending on your search it can either be applied at the indexers level or at the SH level. ... View more

Do you by any chance know how you can change the default iplocation command to return the extra fields that come with the premium version? I'm struggling locating the iplocation script, it's not in etc/apps/search/bin as expected. ... View more

You should do it on both otherwise you are going to have discrepancies. Iplocation is a streaming command and depending on your search it can either be applied at the indexers level or at the SH level. ... View more

Even though that seems like an old question let me give you my 2 cents since I encountered the same problem. Let me start by clarifying that this question is not about the maxresultsrows that is set by default to 50k, the op is already paginating through the results and he is getting them in chunks of 50k. The problem here is another limit of 500k. (notice the extra 0) max_count = <integer> * The number of events that can be accessible in any given status bucket (when status_buckets = 0). * The last accessible event in a call that takes a base and count. * Note: This value does not reflect the number of events displayed in the UI after the search is evaluated or computed. * Default: 500000 You have to change that limit. ... View more