- Splunk Answers
- :
- Using Splunk
- :
- Reporting
- :
- Re: Output Results to Lookup Truncating Results
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello, Hoping for some guidance.
I have a scheduled report that has been running weekly for several months now without any issues. I am outputting the results to a lookup file and replacing the results with each run.
As of this week the lookup no longer contains all of the results, it is limited to 175,000 results.
If I run the report manually as a search and export it, I get the correct results 181,113
I haven't been able to find any info related to limits on lookups. Is there a conf file config related to max results or max file size?
The latest file was 36.1 MB.
Any help would be greatly appreciated!
Thank you.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Don’t use alert action to lookup. Use the outputlookup command at the end of your SPL. That should help.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Don’t use alert action to lookup. Use the outputlookup command at the end of your SPL. That should help.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi colleagues,
i have faced the same issue and just curious where actually the limitation defined (for alert action to lookup )
KR, Lis
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
damn! you are awsome..
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Worked perfectly, funny how you caught up over thinking and missing the obvious!
Thank you for the assistance!
Join Us for Splunk University and Get Your Bootcamp Game On!
.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!
Announcing Scheduled Export GA for Dashboard Studio
