How can I export more than 10000 results from the Splunk UI?

As of Splunk 4.3, you can now export an unlimited number of events from the UI. Do note, however, that exporting too many events in that manner (typically, several millions) could cause Splunkweb to misbehave and possibly to become temporarily unresponsive.

If you really need to often export large number of events, we would still recommend the use of the outputcsv command and/or to run the search from the CLI.

Splunk for Excel Export will allow you to export more than 10K results:

Splunk for Excel Export on Splunkbase

This is still an issue ("safety feature") as of 4.2.

I find this especially frustrating when you have a search that you have spent a long time (hours, days...) running and find it has a few events over the 10,000 limit. And you need those events exported to CSV badly.

Here is what I had to do to get them all. Important notes: this requires filesystem-level access to the searchhead that ran the search, may take a lot of CPU (unzipping), *and* if you have different data types in the search, with differing numbers of fields, perhaps you shouldn't strip out the field names as instructed below (replace awk FNR-1 with cat.)

• First of all, save the search results via Actions->Save Results, so they don't disappear on you.
• Next, open the Jobs window and locate your search in the listing. It will likely be listed as "Done" or "Finalized" status. Click the search text to open the search results, and copy the sid value from the end of the URL.
• On the search head's filesystem, go to $SPLUNK_HOME/var/run/splunk/dispatch/sid
• Copy the events directory to a separate folder (cp -r events/ events_temp)
• Un-gzip all the files in the temp folder (gunzip events_temp/*)
• Concatenate all the files together, ignoring the headers (this can get big. Sorry, I don't know how to do this on Windows. *nix is awk FNR-1 events_temp/* >> fullresults.csv)
• Fullresults.csv is now the full listing of all fields in all events. As I mentioned before, I hope your number of fields are the same for all events returned, otherwise you'll have a mess to clean up.