Splunk Search

How to use the C# SDK to return a large search result set (5,000,000 rows)?

pateld
Explorer

Hi

I have a "Saved Report" (Named- GetIP), which finds unique IP passed through firewall for th Last 30 days. It reports data approximately 5,000,000 rows.

Search is like this:

index=myIPIndex  | stats max(_time) as LastSeen,Count by foundIP | convert ctime(LastSeen) | sort -LastSeen

I am using C# SDK 2.0. Can someone provide working example to retrieve all 5,000,000 rows? I am getting only first 10,000 rows which is max row defined by Splunk.

Thanks

0 Karma
1 Solution

lguinn2
Legend

For a start, don't use the sort command in your search. The sort command output is limited to 10,000 results; this is probably the source of your difficulties. See the sort documentation here.

Plus, if you want to sort 5 million values, do it outside of Splunk...

View solution in original post

lguinn2
Legend

For a start, don't use the sort command in your search. The sort command output is limited to 10,000 results; this is probably the source of your difficulties. See the sort documentation here.

Plus, if you want to sort 5 million values, do it outside of Splunk...

pateld
Explorer

I was "sort" command which has limit for 10000
thanks

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...