Hi,
I am using an external lookup to basically run a Python script which runs an API call to return the results using a csv.dictwriter to the sys.stdout.
There are around 1250 rows being written to the console
But only the first 100 rows are being shown in Splunk.
How can I disable this 100-row limit on external lookups?
Thank you and have a nice day,
Best,
To give more context: https://dev.splunk.com/enterprise/docs/devtools/externallookups/createexternallookup/
Also had found about the keyword to be added in transforations.conf
max_matches
but this has an upper limit of 1000. I need more...
Refer: https://docs.splunk.com/Documentation/Splunk/latest/Admin/Transformsconf#Lookup_tables
You can't have more. You might be able to "walk around" this limitation by writing custom command - it's bound by other rules than scripted lookup.