good afternoon
I have a lookups that has 11737540 lines, but when I see it in splunk, it only shows me half
| inputlookup msisdn_sus_Todos.csv
5,004,673 results
Does anyone have any idea how to fix this? that all the values are shown or you have to increase some value in the limits.conf
regards
You can try below syntax in /opt/splunk/etc/system/local/limits.conf and check the change in results.
[searchresults]
max_mem_usage_mb = 400
maxresultrows = 10000000
tocsv_maxretry = 10
tocsv_retryperiod_ms = 1000