Splunk Search

Exporting more than 50k rows in lookup editor app?

smanojkumar
Communicator

Hi There!

   I would like to export more than 50k rows in lookup editor app of the results of kv store lookup file, 

   I tried even changing the limits.config file, but it is not working fine,

[searchresults]
maxresultrows = 500000
[stats]
maxresultrows = 500000
[top]
maxresultrows = 500000

Can anyone say about the solution for this?

 

Thanks in Advance!

Labels (1)
0 Karma

shivanshu1593
Builder

Hello @smanojkumar ,

Lookups can have millions of results, especially the KVStore lookup. Looks like the SPL that you wrote, whose' results you're trying to output to the lookup is truncating your results. Can be caused either by using the sort command or append, join or even subsearches. Could you share your SPL, masking sensitive information in it, so that we could try to identify the problem.

Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
0 Karma

smanojkumar
Communicator

We are having the same query and configuration in dev and prod environment, where us in dev it is working fine, we can export more than 50k records but not in prod environment, since we are having same query in prod environment as well.
Any other things that restrict the export more than 50k records?

Any other reason which can cause this issue.

I would like to know, Is that something related to licensing, also I can see version in prod and dev are same.

 

Thanks in Advance!

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...