We are delighted to share our new EIC Delivery Methodology for efficiently managing Saviynt Implementations and delivering quick time to value. CLICK HERE.

Splunk Integration is fetching only 50 records

smithamg
Regular Contributor
Regular Contributor
Hi Team,
 
We have integrated the Splunk add on following the steps provided in 
 
Also, created a runtime analytics and user as mentioned in 
 
We are now getting logs in Splunk but only 50 records every time even though report has 200+ records.
 
Kindly help us to resolve this issue.
 
Thanks,
Smitha
9 REPLIES 9

Darshanjain
Saviynt Employee
Saviynt Employee

Hi @smithamg 

You can use the max=500 in the url to get more results,

If you need more than 500 results in one page, there is a config table where that value is stored you can keep it till 10000 and call the url with max=10000, then you would be able to get all the results.

As you said you are looking only for 200+, you can directly pass this in the url &max=500 should get you the result.

Ws_max_records_returned

smithamg
Regular Contributor
Regular Contributor

Hi @Darshanjain

Thanks for your response. 

I am little confused when you say to use max=500 in URL. Below is our saviynt add on config in Splunk

smithamg_2-1677834962989.png

Which URL you are referring to?

Thanks,
Smitha

In the Runtime analytics of saviynt URL

smithamg
Regular Contributor
Regular Contributor

Can you please provide any sample URL..

We are not making API call directly to fetch the report. We are using Splunk add on downloaded from
Splunk Integration Guide : Customer Portal (freshdesk.com)

Hi @smithamg 

I have checked and could see that the current add on file doesn't automatically calculate offset value , so the records are not being fetched,  So we have created a new add on file which is already at the edge of testing phase which will internally calculate the offset value and provide all the records. ( by next week the new add on file will be available )

You can check the documentation in next week to get the latest add on file.

 

Thanks

Darshan 

Falcon
Saviynt Employee
Saviynt Employee

Smitha,

We are in the middle of publishing the new add-on that supports pagination on Splunkbase as well as our documentation portal in next few days. In the meanwhile you can use this link to download https://drive.google.com/file/d/1IT-dcs2wKuSTu_RwkSkgDAVDKUUlFBch/view?usp=share_link. Also attached the add-on here

smithamg
Regular Contributor
Regular Contributor

It worked. Thanks for the updated add-on.

smithamg
Regular Contributor
Regular Contributor

@Falcon @Darshanjain is there any limit on the number of records that returned by report. We have a report with 60K+ records, does Splunk add on capable of handling this?

Hi @smithamg 

Yes it should be able to handle as it is using pagination concept ( offset to fetch all records ).

 

Thanks

Darshan