search

splunk / splunk-sdk-python

Splunk Software Development Kit for Python
http://dev.splunk.com
Apache License 2.0
698 stars 370 forks source link

Truncated List of Indexes Returned in Cloud Environments with a large number of Indexes. #452

Closed djsincla closed 2 years ago

djsincla commented 2 years ago

I have a application modular input using the Splunk SDK. Index is one of the application configuration options not directly controlled by my application presented to the customer to choose from. In a Cloud environment with several thousand indexes to choose from, the customer is receiving only a subset of the available Indexes defined. Some buffer or some other count is preventing the full index list to be presented.

ashah-splunk commented 2 years ago

Hi @djsincla, We tried to reproduce the issue by creating more than 10K indexes and tried to fetch the index list through SDK and we got the full list of indexes. Also for Modular Inputs to select the index from the Splunk Web we were able to get the full list of indexes. If you can tell us a bit more about how you are using modular inputs in your script and how the customers are choosing from indexes(from Splunk Web or SDK ) would help us to understand the scenario. And also how many indexes are there in your Splunk application?

djsincla commented 2 years ago

It is a customer using my modular input in Splunk Cloud. Is there a way I can share customer details privately?

Regards Dwayne

On Jun 3, 2022, at 6:00 AM, ashah-splunk @.***> wrote:

 Hi @djsincla, We tried to reproduce the issue by creating more than 10K indexes and tried to fetch the index list through SDK and we got the full list of indexes. Also for Modular Inputs to select the index from the Splunk Web we were able to get the full list of indexes. If you can tell us a bit more about how you are using modular inputs in your script and how the customers are choosing from indexes(from Splunk Web or SDK ) would help us to understand the scenario. And also how many indexes are there in your Splunk application?

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you were mentioned.

fantavlik commented 2 years ago

Hi @djsincla it sounds like this issue is related to your particular Splunk Cloud setup and possibly tied to role-based access control within your Splunk Cloud deployment - since you are a Splunk Cloud customer the best avenue would be to file a Support ticket https://splunkcommunities.force.com/customers/home/home.jsp and the modular input and other account-specific details can be shared with that support professional. I hope that helps!