Splunk Integration is fetching only 50 records

[smithamg]

Hi Team,

We have integrated the Splunk add on following the steps provided in 

Splunk Integration Guide : Customer Portal (freshdesk.com)

Also, created a runtime analytics and user as mentioned in 

Saviynt SIEM Integration : Customer Portal (freshdesk.com)

We are now getting logs in Splunk but only 50 records every time even though report has 200+ records.

Kindly help us to resolve this issue.

Thanks,

Smitha

[Darshanjain]

Hi @smithamg 

You can use the max=500 in the url to get more results,

If you need more than 500 results in one page, there is a config table where that value is stored you can keep it till 10000 and call the url with max=10000, then you would be able to get all the results.

As you said you are looking only for 200+, you can directly pass this in the url &max=500 should get you the result.

Ws_max_records_returned

[smithamg]

Hi @Darshanjain

Thanks for your response. 

I am little confused when you say to use max=500 in URL. Below is our saviynt add on config in Splunk

Which URL you are referring to?

Thanks,
Smitha

[Darshanjain]

In the Runtime analytics of saviynt URL

[smithamg]

Can you please provide any sample URL..

We are not making API call directly to fetch the report. We are using Splunk add on downloaded from
Splunk Integration Guide : Customer Portal (freshdesk.com)

[Darshanjain]

Hi @smithamg 

I have checked and could see that the current add on file doesn't automatically calculate offset value , so the records are not being fetched,  So we have created a new add on file which is already at the edge of testing phase which will internally calculate the offset value and provide all the records. ( by next week the new add on file will be available )

You can check the documentation in next week to get the latest add on file.

Thanks

Darshan 

[Falcon · Accepted solution]

Smitha,

We are in the middle of publishing the new add-on that supports pagination on Splunkbase as well as our documentation portal in next few days. In the meanwhile you can use this link to download https://drive.google.com/file/d/1IT-dcs2wKuSTu_RwkSkgDAVDKUUlFBch/view?usp=share_link. Also attached the add-on here

[smithamg]

It worked. Thanks for the updated add-on.

[smithamg]

@Falcon @Darshanjain is there any limit on the number of records that returned by report. We have a report with 60K+ records, does Splunk add on capable of handling this?

[Darshanjain]

Hi @smithamg 

Yes it should be able to handle as it is using pagination concept ( offset to fetch all records ).

Thanks

Darshan