Splunk Search

outputlookup is limited to 10,000 results

jambajuice
Communicator

I need to create an outputlookup file with more than 10,000 results. I've looked through the limits.conf examples and I can't find a way to increase the number of results beyond 10K.

Is this possible?

Craig

Tags (1)

rfiscus
Path Finder

Yup, sort was killing it for me. Thanks!

steveyz
Splunk Employee
Splunk Employee

What is the full search? outputlookup itself does not have any results limits, and a limit of 10k would mostly be due to a sort command you may be using. (sort implicitly truncates to the first 10k output rows unless you specify limit=0 as an argument to it)

rdownie
Communicator

sort limit=0 worked for me.
Thanks.

0 Karma

steveyz
Splunk Employee
Splunk Employee

try using fields instead of table

0 Karma

jambajuice
Communicator

The search is:

sourcetype="nessus_plugins" | table nessus_id,cve_id,osvdb_id | outputlookup osvdb_cvs_lookup.csv

If I remove the outputlookup part of the search, it still maxes out at 100000 events.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...