Splunk Search

Custom Splunk search command only returns 100 results

New Member

I'm writing a custom Splunk search command that runs a query on another Splunk host, then returns those results. Unfortunately, no matter what inputs I use in the search or arguments I change for the job creation the search only returns 100 results, but the job object returned by the Python SDK correctly identifies the ~30k results it should have in job['resultCount'].

Is there something I am missing in this process to get the SDK to give me all of the results? Please note that the command is called "ril", and it does not modify the results from the job at all, it only returns them. I will include as much information as I can below as to how the command is integrated into the app.

Thank you in advance.

ril.py (edited for brevity)

service = client.connect(host=HOST, port=PORT, username=USERNAME, password=PASSWORD)

query = QUERY
kwargs = {"exec_mode": "normal", "count" : 0}
job = service.jobs.create(query, **kwargs)

# Poll for completion
while True:
    while not job.is_ready():
    if job["isDone"] == "1":

# Touch each result, make a dict of them to be passed to Intersplunk.outputResults()
newresults = []
for result in results.ResultsReader(job.results()):

# Output results to Splunk


filename = ril.py
generating = true


access = read : [ * ], write : [ admin, power ]
0 Karma


Amend your code at line 17 and try this:

for result in results.ResultsReader(job.results(count=0)):

otherwise, you may have to edit your limits.conf file to add a stanza like below:

maxresultrows = 4294967295

Hopefully, that does the trick.

0 Karma


what's the query?

0 Karma

New Member

It is simply an inputlookup with nothing after. I intend for this command to be a remote version of inputlookup to allow synchronizing lookups based on Splunk triggers.

The name of the lookup/csv file as well as any arguments passed in the custom command are directly passed into the inputlookup command on the remote server as well, but no other SPL commands are included in that query.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!