SplunkEnterprise Retriever should return more than 100 items from a metric

[jasonp-3019]

Component(s)

receiver/splunkenterprise

Is your feature request related to a problem? Please describe.

The SplunkEnterprise Receiver currently returns the first 100 elements when querying a metric (tested with splunk.license.index.usage) instead of all elements that a metric should return. This currently leads to situations where we are missing data that we expect to receive and leaves gaps within our monitoring tools.

Describe the solution you'd like

The SplunkEnterprise Receiver should return all elements of any metric.

Describe alternatives you've considered

No response

Additional context

No response

Tip

_{React with 👍 to help prioritize this issue. Please use comments to provide useful context, avoiding +1 or me too, to help us triage it. Learn more here.}

[github-actions]

Pinging code owners:

• receiver/splunkenterprise: @shalper2 @MovieStoreGuy @greatestusername

See Adding Labels via Comments if you do not have permissions to add labels yourself.

[shalper2]

Howdy! Thanks for opening this issue! This all boils down to a count field which is omitted in the current GET request for retrieving results from the Splunk instance. The omitted field defaults to a value of 100, which at the time of the components initial creation seemed pretty generous! I think that adding proper handling of larger-than-one-hundred results is a good enhancement to the component. Please assign this to me.

[jasonp-3019]

@shalper2 thanks for taking a look - doesn't look like I've got permission to assign you though