Under 4.3, you have the ability to export either Unlimited or 10000 results. Looks like in the Advanced Charting view, unlimited does not work at all for any of the 3 formats: CSV, XML or JSON. Has anyone else seen this behavior?
In 4.3 through 4.3.2 this is a known issue, SPL-51334.
The temporary workaround is to make the simple modification in the charting view's xml as below.
Note: a restart is not necessary and the number of results returned is not a factor
Modify the charting view's xml via:
Manager > User Interface > Views > charting
Replace the text "event" to "result" in the following line and Save:
From:
<module name="Export"><param name="exportType">event</param></module>
To:
<module name="Export"><param name="exportType">result</param></module>
For me it's broken whether or not you pick unlimited or whether you set a limit. The problem seems to arise when the search is anything other than a trivial "events" search. IE if you have any stats commands in there, or any transforming/reporting commands, the export will generate only an empty csv.
In 4.3 through 4.3.2 this is a known issue, SPL-51334.
The temporary workaround is to make the simple modification in the charting view's xml as below.
Note: a restart is not necessary and the number of results returned is not a factor
Modify the charting view's xml via:
Manager > User Interface > Views > charting
Replace the text "event" to "result" in the following line and Save:
From:
<module name="Export"><param name="exportType">event</param></module>
To:
<module name="Export"><param name="exportType">result</param></module>