How do I evade the limit of 100 entries in python splunk query

Question

When executing a query via the splunk SDK, apparently the results are clipped after 100 entries. How to get around this limit?

I tried:

>job = service.jobs.create(qstring,max_count=0, max_time=0, count=10000)
>while not job.is_ready():
    time.sleep(1)
>out = list(results.ResultsReader(job.results()))
>print(len(out))
100

but the same query in the splunk web interface produces over 100 lines of results.

http://dev.splunk.com/view/SP-CAAADQT suggests that the http request should contain a "count" line in its data. — mdurant, Dec 15 '14 at 20:26
what is `qstring` here? Is the query limiting the results to 100 items? — ComputerDruid, Dec 15 '14 at 20:38
No it certainly isn't :) that's why the same very search in the webapp returns more than 100 entries. qstring is specific to my search, and I can't connect you to my data sources, of course. — mdurant, Dec 15 '14 at 20:39

score 4 · Answer 1 · answered Jan 06 '15 at 23:00

4

Try job.results(count=0) count=0 means no limit.

answered Jan 06 '15 at 23:00

AEM

41
1

it *does" work on my side. code: for result in results.ResultsReader(job.results(count=0)): – Paul Feb 13 '15 at 03:38
In my case (with a saved search) it did work if I passed count = 0 in as one of the kwargs to job.results. – russellpierce Jul 07 '15 at 16:55

mdurant · Accepted Answer · 2014-12-16T15:27:59.740

1

Here is a hack which appears to work (but this is surely not the right way to do this):

in splunklib.binding

HttpLib.get and HttpLib.post, add the following line to the beginning of each method:

kwargs['count'] = 100000

edited Dec 16 '14 at 15:27

answered Dec 15 '14 at 21:07

mdurant

27,272
5
45
74

How do I evade the limit of 100 entries in python splunk query

2 Answers2

Linked