Getting Data In

REST API: Why am I hitting a limit of 100 exported results?

MHibbin
Influencer

Hi,

I am trying to get some results out of Splunk using the REST API, I have the following in my script:

uri = "/services/search/jobs/" + str(sid) + "/results"
data = urllib.urlencode({"count":"0", "output_mode":"csv"})
response, content = h.request(base_url + uri, "get", data)

However, it is only downloading 100 results (101 rows including header).

I'm probably overlooking something as I've only started really using the interface. Any thoughts, on why I'm still getting the default number of results.

Thanks,

MHibbin

0 Karma

trsavela
Path Finder

If I recall the splunk only send the first page by default. I had a similar issue using the SDK a while back, I collect the rest of the pages programmatically in that case.

Adding count like you did is the only way I know about using pure REST.

0 Karma

MHibbin
Influencer

Just come across this blog article:

http://blogs.splunk.com/2011/08/02/splunk-rest-api-is-easy-to-use/

At the moment I have appended my URI with ?output_mode=json&count=0, which seems to work.

Still, I am curious to know what was wrong in the first place, unless this is the correct method, and I have misread the documentation.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...