How to Export Large amount of Rows in CSV

Applicability

Description

Splunk Cloud limits CSV exports from the user interface to 50,000 rows. This article explains the supported limitations and the available options for exporting larger result sets. 

 

Resolution

Splunk Cloud has a limit of 50,000 rows to export into a CSV. (As of the writing of this article they do not go beyond it.)

To edit the settings on the UI, do the following:

"Settings > Searches, Reports, and Alerts > Edit > Advanced Edit" 

See the following link for additional information:
Exporting Large Results Sets to CSV

For Splunk Cloud:

• It is not possible to modify limits.conf or to change alert_actions.conf.

It is also possible to export a large amount of rows, in groups of 50,000. With a combination of head and tail.

<search> |head 50000 (gives the first 50,000)
<search> |head 100000 |tail 50000 (would give 50001 to 100000)

This is obviously not ideal, but it will allow to export a large number of rows in several iterations.

For reference, these are the CLI settings involved. Done on the Cluster manager.

splunk@c0m1-<hostname>:~$
vi ~etc/system/local/limits.conf
[scheduler]
max_action_results = 50000

[searchresults]
maxresultrows = 50000
 
vi ~etc/system/local/alert_actions.conf
[email]
maxresults = 50000

Do a bundle push.

Reference

max_action_results = <integer>
* The maximum number of results to load when triggering an alert action.
* Default: 50000maxresultrows = <integer>
* Configures the maximum number of events are generated by search commands
  which grow the result size set (such as multikv) or that create
  events. Other search commands are explicitly controlled in specific stanzas
  below.
* This limit should not exceed 50000.
* Default: 50000

maxresults = <integer>
* Set the global maximum number of search results sent through alerts.
* Default: 100

Related Links

Exporting Large Results Sets to CSV