|
Hi , is there any way to extend the limitation ( maximum 10,000 records ) of results table in flashtimeline view (Splunk 4.3.0) ? thanks˜ Owen |
|
Why do you need to display more than 10,000 results in the results table? You can't possibly view 10,000 rows of results at the same time. I would recommend against changing values in limits.conf. There are a plethora of good reasons not to change settings in limits.conf, many of which you can find by searching this site. Hi Araitz, thanks for your answer. customer asked me, why he can view more than 10,000 events in "Events list" and "Events table" but can not view more than 10,000 events in "Results table" ? all those three modules are in "flashtimeline" view. and I remember there is no limitation in 4.2.x version. which configuration in limits.conf is relative to this case ? I can't find it. Regards, Owen
(03 Feb, 16:59)
dmlee
see this post:
(04 Feb, 12:17)
araitz ♦♦
Hi Araitz, I am sorry to confuse you, but I am not asking about how to export more than 10000 events. I think I should paste a screen-shut , but I don't know how to paste ...
(08 Feb, 22:05)
dmlee
I understand you are not trying to export. The limit on the number of results that are saved and can be retrieved is a safety setting. If you want to view (or export) more than 10k results, you should not use the browser and instead use our REST API or CLI.
(09 Feb, 05:37)
araitz ♦♦
|
