qp_splunk_poc_bugfix/msticpy_qp_splunk.ipynb

{
 "cells": [
  {
   "attachments": {},
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# PoC: SplunkGeneral.get_events_parameterized function will fetch all the Splunk records\n",
    "\n",
    "with my PR code https://github.com/microsoft/msticpy/pull/657\n",
    "\n",
    "\n",
    "Reference Splunk SDK python:\n",
    "- https://dev.splunk.com/enterprise/docs/devtools/python/sdk-python/howtousesplunkpython/howtodisplaysearchpython/#To-paginate-through-a-large-set-of-results\n",
    "- https://dev.splunk.com/enterprise/docs/devtools/python/sdk-python/howtousesplunkpython/howtorunsearchespython/\n",
    "\n",
    "- https://docs.splunk.com/DocumentationStatic/PythonSDK/1.7.2/client.html\n",
    "- https://docs.splunk.com/DocumentationStatic/PythonSDK/1.7.2/results.html\n",
    "\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "2023-04-18 13:40:04,642: WARNING - config validation error Missing or empty 'AzureSentinel' section (nbinit#697)\n",
      "2023-04-18 13:40:04,643: WARNING - Could not find msticpyconfig.yaml in standard search. (nbinit#710)\n"
     ]
    },
    {
     "data": {
      "text/html": [
       "<p style=''><font color='orange'><h3>Notebook setup completed with some warnings.</h3></p>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<p style=''>One or more configuration items were missing or set incorrectly.</p>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<p style=''>Please run the <i>Getting Started Guide for Azure Sentinel ML Notebooks</i> notebook. and the <a href='https://msticpy.readthedocs.io/en/latest/getting_started/msticpyconfig.html'>msticpy configuration guide</a>.</p>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    },
    {
     "data": {
      "text/html": [
       "<p style=''>This notebook may still run but with reduced functionality.</p>"
      ],
      "text/plain": [
       "<IPython.core.display.HTML object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    }
   ],
   "source": [
    "import msticpy as mp\n",
    "mp.init_notebook()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "connected\n"
     ]
    }
   ],
   "source": [
    "splunk_prov = mp.QueryProvider(\"Splunk\")\n",
    "splunk_prov.connect()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Query:  get_events_parameterized\n",
      "Data source:  Splunk\n",
      "Generic parameterized query from index/source\n",
      "\n",
      "Parameters\n",
      "----------\n",
      "add_query_items: str (optional)\n",
      "    Additional query clauses\n",
      "    (default value is: | head 100)\n",
      "end: datetime\n",
      "    Query end time\n",
      "index: str (optional)\n",
      "    Splunk index name\n",
      "    (default value is: *)\n",
      "project_fields: str (optional)\n",
      "    Project Field names\n",
      "    (default value is: | table TimeCreated, host, EventID, EventDescripti...)\n",
      "source: str (optional)\n",
      "    Splunk source type\n",
      "    (default value is: *)\n",
      "start: datetime\n",
      "    Query start time\n",
      "timeformat: str (optional)\n",
      "    Datetime format to use in Splunk query\n",
      "    (default value is: \"%Y-%m-%d %H:%M:%S.%6N\")\n",
      "Query:\n",
      " search index={index} source={source} timeformat={timeformat} earliest={start} latest={end} {project_fields} {add_query_items}\n"
     ]
    }
   ],
   "source": [
    "splunk_prov.SplunkGeneral.get_events_parameterized('?')"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Test with botsv2 data"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "' search index=botsv2 source=WinEventLog:Microsoft-Windows-Sysmon/Operational timeformat=\"%Y-%m-%d %H:%M:%S\" earliest=\"2017-08-25 00:00:00\" latest=\"2017-08-25 10:00:00\" | table TimeCreated, host, EventID, EventDescription, User, process, cmdline, Image, parent_process, ParentCommandLine, dest, Hashes | head 100'"
      ]
     },
     "execution_count": 3,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "splunk_prov.SplunkGeneral.get_events_parameterized('print',\n",
    "    index=\"botsv2\",\n",
    "    source=\"WinEventLog:Microsoft-Windows-Sysmon/Operational\",\n",
    "    timeformat='\"%Y-%m-%d %H:%M:%S\"',\n",
    "    start=\"2017-08-25 00:00:00\",\n",
    "    end=\"2017-08-25 10:00:00\"\n",
    ")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {},
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "Waiting Splunk job to complete: 200.0it [00:03, 60.67it/s]                          "
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "100.0%   11268 scanned   11268 matched   100 results\n",
      "Splunk job has Done!\n"
     ]
    },
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "\n"
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Implicit parameter dump - 'paginate_width': 100 ,which means 100 records will be retrieved per one fetch.\n",
      "  You can set paginate_width=<integer> to this function's option.\n"
     ]
    },
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "Waiting Splunk result to retrieve: 200it [00:00, 17219.06it/s]            "
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Retrieved 100 results.\n"
     ]
    },
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "100"
      ]
     },
     "execution_count": 4,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "default_df = splunk_prov.SplunkGeneral.get_events_parameterized(\n",
    "    index=\"botsv2\",\n",
    "    source=\"WinEventLog:Microsoft-Windows-Sysmon/Operational\",\n",
    "    start=\"2017-08-25 00:00:00.000000\",\n",
    "    end=\"2017-08-25 10:00:00.000000\"\n",
    ")\n",
    "len(default_df) # 100 because of add_query_items = '| head 100' by default"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### fetch unlimited records "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "' search index=botsv2 source=WinEventLog:Microsoft-Windows-Sysmon/Operational timeformat=\"%Y-%m-%d %H:%M:%S.%6N\" earliest=\"2017-08-25 00:00:00\" latest=\"2017-08-25 10:00:00\" | table TimeCreated, host, EventID, EventDescription, User, process, cmdline, Image, parent_process, ParentCommandLine, dest, Hashes '"
      ]
     },
     "execution_count": 10,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "splunk_prov.SplunkGeneral.get_events_parameterized('print',\n",
    "    index=\"botsv2\",\n",
    "    source=\"WinEventLog:Microsoft-Windows-Sysmon/Operational\",\n",
    "    start=\"2017-08-25 00:00:00.000000\",\n",
    "    end=\"2017-08-25 10:00:00.000000\",\n",
    "    add_query_items=''\n",
    ")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "metadata": {},
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "Waiting Splunk job to complete: 200.0it [00:03, 60.83it/s]                          "
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "100.0%   11268 scanned   11268 matched   11268 results\n",
      "Splunk job has Done!\n"
     ]
    },
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "\n"
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Implicit parameter dump - 'paginate_width': 100 ,which means 100 records will be retrieved per one fetch.\n",
      "  You can set paginate_width=<integer> to this function's option.\n"
     ]
    },
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "Waiting Splunk result to retrieve: 22568it [00:01, 16391.93it/s]                          "
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Retrieved 11268 results.\n"
     ]
    },
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "\n"
     ]
    }
   ],
   "source": [
    "result_df = splunk_prov.SplunkGeneral.get_events_parameterized(\n",
    "    index=\"botsv2\",\n",
    "    source=\"WinEventLog:Microsoft-Windows-Sysmon/Operational\",\n",
    "    start=\"2017-08-25 00:00:00.000000\",\n",
    "    end=\"2017-08-25 10:00:00.000000\",\n",
    "    add_query_items='',\n",
    "    count=0\n",
    ")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "11268"
      ]
     },
     "execution_count": 13,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "len(result_df)"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Test with original csv \"msticpy_splunk_reader_paging-test.csv\""
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "metadata": {},
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "Waiting Splunk job to complete: 200.0it [00:03, 60.31it/s]                         "
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "100.0%   100000 scanned   100000 matched   100000 results\n",
      "Splunk job has Done!\n"
     ]
    },
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "\n"
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Implicit parameter dump - 'paginate_width': 100 ,which means 100 records will be retrieved per one fetch.\n",
      "  You can set paginate_width=<integer> to this function's option.\n"
     ]
    },
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "Waiting Splunk result to retrieve: 200000it [00:39, 5096.06it/s]                           \n"
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Retrieved 100000 results.\n"
     ]
    }
   ],
   "source": [
    "# paginate_width = 100 by default\n",
    "result_df = splunk_prov.SplunkGeneral.get_events_parameterized(\n",
    "    index=\"msticpy\",\n",
    "    source=\"msticpy_splunk_reader_paging-test.csv\",\n",
    "    project_fields=\"| table timestamp,rownum, desc, uuid4, host\",\n",
    "    add_query_items='',\n",
    "    count=0\n",
    ")\n",
    "result_df['timestamp'] = result_df['timestamp'].astype('float')\n",
    "result_df['rownum'] = result_df['rownum'].astype('int')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "100000"
      ]
     },
     "execution_count": 15,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "len(result_df)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "array([     1,      2,      3, ...,  99998,  99999, 100000])"
      ]
     },
     "execution_count": 16,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "sort_df = result_df.sort_values('rownum')\n",
    "sort_df['rownum'].to_numpy()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 17,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>timestamp</th>\n",
       "      <th>rownum</th>\n",
       "      <th>desc</th>\n",
       "      <th>uuid4</th>\n",
       "      <th>host</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>91428</th>\n",
       "      <td>1.681780e+09</td>\n",
       "      <td>1</td>\n",
       "      <td>testing_rownum1</td>\n",
       "      <td>7230ab65-7622-4aea-8f89-e0cf94028e80</td>\n",
       "      <td>hackeTlab.local</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>91427</th>\n",
       "      <td>1.681780e+09</td>\n",
       "      <td>2</td>\n",
       "      <td>testing_rownum2</td>\n",
       "      <td>0673a921-400f-4f74-9955-2ebe3aa6b568</td>\n",
       "      <td>hackeTlab.local</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>91426</th>\n",
       "      <td>1.681780e+09</td>\n",
       "      <td>3</td>\n",
       "      <td>testing_rownum3</td>\n",
       "      <td>1b7d33b8-797f-4b19-978e-89d126d1736d</td>\n",
       "      <td>hackeTlab.local</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>91425</th>\n",
       "      <td>1.681780e+09</td>\n",
       "      <td>4</td>\n",
       "      <td>testing_rownum4</td>\n",
       "      <td>9b513862-7cb3-436b-b9b0-cee880d4c19b</td>\n",
       "      <td>hackeTlab.local</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>91424</th>\n",
       "      <td>1.681780e+09</td>\n",
       "      <td>5</td>\n",
       "      <td>testing_rownum5</td>\n",
       "      <td>96feff47-29db-4d78-a221-f96df595200f</td>\n",
       "      <td>hackeTlab.local</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>...</th>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>9912</th>\n",
       "      <td>1.681780e+09</td>\n",
       "      <td>99996</td>\n",
       "      <td>testing_rownum99996</td>\n",
       "      <td>b051d150-b26d-4149-bd28-70f800229ede</td>\n",
       "      <td>hackeTlab.local</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>9911</th>\n",
       "      <td>1.681780e+09</td>\n",
       "      <td>99997</td>\n",
       "      <td>testing_rownum99997</td>\n",
       "      <td>a2192da0-8262-43fb-9301-bd4780a9b499</td>\n",
       "      <td>hackeTlab.local</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>9910</th>\n",
       "      <td>1.681780e+09</td>\n",
       "      <td>99998</td>\n",
       "      <td>testing_rownum99998</td>\n",
       "      <td>57cd4cf6-b5e8-41dc-815e-870092c54caa</td>\n",
       "      <td>hackeTlab.local</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>9909</th>\n",
       "      <td>1.681780e+09</td>\n",
       "      <td>99999</td>\n",
       "      <td>testing_rownum99999</td>\n",
       "      <td>a3a13916-89b8-4922-967e-ab680131ff39</td>\n",
       "      <td>hackeTlab.local</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>12499</th>\n",
       "      <td>1.681780e+09</td>\n",
       "      <td>100000</td>\n",
       "      <td>testing_rownum100000</td>\n",
       "      <td>9ac20835-91d1-42f5-8e43-6289ea79fc17</td>\n",
       "      <td>hackeTlab.local</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>100000 rows × 5 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "          timestamp  rownum                  desc  \\\n",
       "91428  1.681780e+09       1       testing_rownum1   \n",
       "91427  1.681780e+09       2       testing_rownum2   \n",
       "91426  1.681780e+09       3       testing_rownum3   \n",
       "91425  1.681780e+09       4       testing_rownum4   \n",
       "91424  1.681780e+09       5       testing_rownum5   \n",
       "...             ...     ...                   ...   \n",
       "9912   1.681780e+09   99996   testing_rownum99996   \n",
       "9911   1.681780e+09   99997   testing_rownum99997   \n",
       "9910   1.681780e+09   99998   testing_rownum99998   \n",
       "9909   1.681780e+09   99999   testing_rownum99999   \n",
       "12499  1.681780e+09  100000  testing_rownum100000   \n",
       "\n",
       "                                      uuid4             host  \n",
       "91428  7230ab65-7622-4aea-8f89-e0cf94028e80  hackeTlab.local  \n",
       "91427  0673a921-400f-4f74-9955-2ebe3aa6b568  hackeTlab.local  \n",
       "91426  1b7d33b8-797f-4b19-978e-89d126d1736d  hackeTlab.local  \n",
       "91425  9b513862-7cb3-436b-b9b0-cee880d4c19b  hackeTlab.local  \n",
       "91424  96feff47-29db-4d78-a221-f96df595200f  hackeTlab.local  \n",
       "...                                     ...              ...  \n",
       "9912   b051d150-b26d-4149-bd28-70f800229ede  hackeTlab.local  \n",
       "9911   a2192da0-8262-43fb-9301-bd4780a9b499  hackeTlab.local  \n",
       "9910   57cd4cf6-b5e8-41dc-815e-870092c54caa  hackeTlab.local  \n",
       "9909   a3a13916-89b8-4922-967e-ab680131ff39  hackeTlab.local  \n",
       "12499  9ac20835-91d1-42f5-8e43-6289ea79fc17  hackeTlab.local  \n",
       "\n",
       "[100000 rows x 5 columns]"
      ]
     },
     "execution_count": 17,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "sort_df"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "OK, Fine.\n",
    "\n",
    "\n",
    "Next is test with paginate_width = 10000"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 18,
   "metadata": {},
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "Waiting Splunk job to complete: 200.0it [00:03, 60.55it/s]                         "
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "100.0%   100000 scanned   100000 matched   100000 results\n",
      "Splunk job has Done!\n"
     ]
    },
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "\n"
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Implicit parameter dump - 'paginate_width': 10000 ,which means 10000 records will be retrieved per one fetch.\n",
      "  You can set paginate_width=<integer> to this function's option.\n"
     ]
    },
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "Waiting Splunk result to retrieve: 200000it [00:00, 227110.13it/s]                            "
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Retrieved 100000 results.\n"
     ]
    },
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "\n"
     ]
    }
   ],
   "source": [
    "# paginate_width = 10000 set to the option\n",
    "result_df2 = splunk_prov.SplunkGeneral.get_events_parameterized(\n",
    "    index=\"msticpy\",\n",
    "    source=\"msticpy_splunk_reader_paging-test.csv\",\n",
    "    project_fields=\"| table timestamp,rownum, desc, uuid4, host\",\n",
    "    add_query_items='',\n",
    "    count=0,\n",
    "    paginate_width=10000,\n",
    ")\n",
    "result_df2['timestamp'] = result_df2['timestamp'].astype('float')\n",
    "result_df2['rownum'] = result_df2['rownum'].astype('int')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 19,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "100000"
      ]
     },
     "execution_count": 19,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "len(result_df2)"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Test with oneshot mode \n",
    "\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 20,
   "metadata": {},
   "outputs": [],
   "source": [
    "result_df_oneshot = splunk_prov.SplunkGeneral.get_events_parameterized(\n",
    "    index=\"msticpy\",\n",
    "    source=\"msticpy_splunk_reader_paging-test.csv\",\n",
    "    project_fields=\"| table timestamp,rownum, desc, uuid4, host\",\n",
    "    add_query_items='',\n",
    "    oneshot=True,\n",
    "    count=0,\n",
    ")\n",
    "result_df_oneshot['timestamp'] = result_df_oneshot['timestamp'].astype('float')\n",
    "result_df_oneshot['rownum'] = result_df_oneshot['rownum'].astype('int')"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 21,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "50000"
      ]
     },
     "execution_count": 21,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "len(result_df_oneshot)"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "oneshot mode hits the splunk limit of maxresultrows (50000 by default) !\n",
    "\n",
    "Points to\n",
    "`service.confs[\"limits\"][\"restapi\"][\"maxresultrows\"]`\n",
    "\n",
    "It's along with my expect."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "msticpy",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.9.12"
  },
  "orig_nbformat": 4
 },
 "nbformat": 4,
 "nbformat_minor": 2
}