I have a user whose search export results are capping at 10Mb ... But with the admin role I can export well beyond that. Anyone know the specific capability that controls this?
Thank you ... Splunk 6.6.3
Per Splunk official documentation, REST or SDK should be use when exporting large amount of data.
Perhaps, you could give it a shot with an email report if you don`t want to play with REST or SDK
http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Search/Exportsearchresults
A little more info ... the user is running a search that returns > 700,000 events ... and they're piping to 'reverse' ... If I remove 'reverse' from the mix, the export works. If I don't, then yes, the export writes around 10-12Mb and then redirects you to a page telling you that the search couldn't be found.
I've asked them to not use reverse for such a large dataset.