Splunk Search

How to retrieve more than 100 record in searchmanager

chrismok
Path Finder

Currently, the dashboard is build in HTML dashboard with javascript, but I found that the searchmanager is only return not more than 100 rows in js. May I know how to control the return no.

 var r = searchmanager1.data('results');
 searchmanager1.on('search:done', function(state,job) {

    console.log('total:' + state.content.resultCount); //Return 270 or more

});

r.on('data', function(results) {
        console.log('length:' + r.data().rows.length); // Only return 100
    });
Tags (1)

AndrewEvelopers
Explorer

Uh I've found it on some github code:

searchManager.data('results', {count: 0, output_mode: 'json'}).on('data', parseData);

bhawkins1
Communicator

In my case I had to use 'json_rows', like so:

searchManager.data('results', {count: 0, output_mode: 'json_rows'}).on('data', parseData);

akath_splunk
Splunk Employee
Splunk Employee

Thank you! This answer saved me a lot of time 🙂

0 Karma

sibrahim
Engager

I signed in just so I could say thank you, you have saved me a whole lot of stress.

0 Karma

AndrewEvelopers
Explorer

Same problem. No ideas?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...