How do I extract events for one year for a single host beyond the 10000 results limit? Older Build 4.0.8, build 73243.
Use the outputcsv command. This will write out all of the events to a *.csv file in Splunk/var/run.
If outputcsv still limits to 10,000, then use outputlookup.
yeah 10000 is a limit set to control performance not a limitation as far as i think.
Google limits.conf. Look at the documentation and find which attribute sets the limit of results (maxResults or something like that). Change it to what you want your limit to be. Restart your instance.
Hope this helps.
