Reporting

Output Results to Lookup Truncating Results

g038123
Explorer

Hello, Hoping for some guidance.
I have a scheduled report that has been running weekly for several months now without any issues. I am outputting the results to a lookup file and replacing the results with each run.
As of this week the lookup no longer contains all of the results, it is limited to 175,000 results.

If I run the report manually as a search and export it, I get the correct results 181,113

I haven't been able to find any info related to limits on lookups. Is there a conf file config related to max results or max file size?
The latest file was 36.1 MB.

Any help would be greatly appreciated!

Thank you.

Labels (1)
1 Solution

starcher
SplunkTrust
SplunkTrust

Don’t use alert action to lookup. Use the outputlookup command at the end of your SPL. That should help.

View solution in original post

starcher
SplunkTrust
SplunkTrust

Don’t use alert action to lookup. Use the outputlookup command at the end of your SPL. That should help.

LIS
Path Finder

Hi colleagues,

i have faced the same issue and just curious where actually the limitation defined (for alert action to lookup )

 

KR, Lis

0 Karma

josephka333
Engager

damn! you are awsome..

0 Karma

g038123
Explorer

Worked perfectly, funny how you caught up over thinking and missing the obvious!
Thank you for the assistance!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...