Splunk Search

Search using C# sdk is returning only 50000 events

ykmohank
New Member

Hi,

From Splunk web interface a saved search is returning around 300,000+ events. While calling the same saved search from C# SDk it is returning only 50,000 events.

Please help me on why i am getting only 50,000 events and how can i read remaining events.

Below is the code that i am referring to.

    var connectArgs = new ServiceArgs
            {
                Host = "myhost.com",
                Port = myportNumber

            };

            // Create new Service object
            Service service = new Service(connectArgs);


            service.Login("admin", "password");


            SavedSearch ObsSearch = service.GetSavedSearches().Get("SavedSearchName");

            Job searchJob = ObsSearch.Dispatch();


            while (!searchJob.IsDone)
            {
                try
                {
                    Thread.Sleep(500);
                }
                catch (Exception ex)
                {
                    Console.WriteLine("Exception Occured :" + ex.ToString());
                    Console.ReadLine();
                }
            }


            JobResultsPreviewArgs previewArgs = new JobResultsPreviewArgs();
            previewArgs.OutputMode = JobResultsPreviewArgs.OutputModeEnum.Xml;
            previewArgs.Count = 0;

            int count = 0;


            using (var stream = searchJob.ResultsPreview(previewArgs))
            {
                using (var rr = new ResultsReaderXml(stream))
                {
                    foreach (var @event in rr)
                    {

                        count ++;
                    }

                }

            }

System.Console.WriteLine("Total events " + count.ToString())

Thanks in advance.

Regards,
Mohan

Tags (1)
0 Karma
1 Solution

Damien_Dallimor
Ultra Champion

50,000 events is the default resultset size to return , as set in the maxresultrows property.

See in limits.conf

It is not recommended to change this.

Rather , in your SDK code you should implement a paging algorithm.

You can reference how to do this in C Sharp here. Scroll down to the "To paginate through a large set of results" section of the page.

View solution in original post

0 Karma

Damien_Dallimor
Ultra Champion

50,000 events is the default resultset size to return , as set in the maxresultrows property.

See in limits.conf

It is not recommended to change this.

Rather , in your SDK code you should implement a paging algorithm.

You can reference how to do this in C Sharp here. Scroll down to the "To paginate through a large set of results" section of the page.

0 Karma

ykmohank
New Member

Thanks for your reply.
I tried paginate option and with this i was able to download 500,000 events where as in reality web interface is returning me 703,186 events.

Is there any other way on getting the remaining records as well.

Job.ResultCount is returning value as 500,000 only.

Pelase help.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...