I'm hoping someone can prove me wrong...
It looks to me as though it is not possible to retrieve all results of a completed search via the REST api.
The REST api does support streaming the entire result of a search initiated via that api request:
curl -k -u me:mypass https://myhost:8089/services/search/jobs/export --data-urlencode search='my SPL here' -d output_mode=csv -d earliest_time='-2d@d' -d latest_time='-1d@d' -o my-output.csv
(see an excellent post here: https://www.splunk.com/blog/2013/09/15/exporting-large-results-sets-to-csv.html)
...and the REST api does support retrieving results one page at a time (where the size of a page is limited to a value in limits.conf-- default 50000:
curl -k -u me:mypass https://myhost:8089/services/search/jobs/1509659457.2999/results -d output_mode=csv -d count=50000 -d offset=0 -o my-output.csv
But to my knowledge, there's no way to retrieve the entire result of a completed search (i.e. by search id) if the size of that result is larger than the page size limit (default 50000).
(note that using the "one page at a time" api in a loop is not desirable because that api appears to have O(n^2) performance-- the first page is nice and fast but the 300th page takes a couple of minutes)
Am I wrong (please!)? Am I crazy (please no!)?
