Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How do I evade the limit of 100 entries in python splunk query

Tags:

python

splunk

When executing a query via the splunk SDK, apparently the results are clipped after 100 entries. How to get around this limit?

I tried:

>job = service.jobs.create(qstring,max_count=0, max_time=0, count=10000)
>while not job.is_ready():
    time.sleep(1)
>out = list(results.ResultsReader(job.results()))
>print(len(out))
100

but the same query in the splunk web interface produces over 100 lines of results.

like image 801
mdurant Avatar asked Sep 30 '22 05:09

mdurant


1 Answers

Try job.results(count=0) count=0 means no limit.

like image 98
AEM Avatar answered Oct 04 '22 04:10

AEM