topic Re: savedsearch not returing more than 10000 results in Getting Data In

savedsearch not returing more than 10000 results

nilbak1 — Tue, 20 Nov 2018 15:14:36 GMT

I have changed action.email.maxresults for one of my savedsearch from 10000 to 100000 but that is not working and I don't want to set it globally in limits.conf and alert_actions.conf as mentioned in
https://answers.splunk.com/answers/542862/how-to-overcome-csv-max-results-to-email.html
as by doing this it will be for all jobs.
Can anyone suggest why this setting action.email.maxresults in savedsearches.conf didn't worked ?

Re: savedsearch not returing more than 10000 results

richgalloway — Tue, 20 Nov 2018 15:26:02 GMT

What is the search? If it has a sort command in it that will limit the results.

Re: savedsearch not returing more than 10000 results

nilbak1 — Tue, 20 Nov 2018 15:47:17 GMT

Hi @richgallow
thanks for looking into it. Search I can't paste here, but its not using sort command

Re: savedsearch not returing more than 10000 results

somesoni2 — Tue, 20 Nov 2018 15:52:08 GMT

Run the btool command to see what settings are applied

./splunk btool savedsearches list YourSavedSearchNameHere --debug

Re: savedsearch not returing more than 10000 results

nilbak1 — Tue, 29 Sep 2020 22:05:08 GMT

[xxxxxxxxxxxxxxxxxxxxxxxx]
action.email = 1
action.email.include.results_link = 0
action.email.maxresults = 100000
action.email.sendcsv = 1
action.email.sendresults = 1
action.email.to = xxxxxxxxxxxxx
action.email.useNSSubject = 1
alert.track = 0
cron_schedule = 45 13 * * *
dispatch.earliest_time = -7d@d
dispatch.latest_time = @d

Re: savedsearch not returing more than 10000 results

ankithnageshshe — Tue, 20 Nov 2018 16:15:26 GMT

What version of Splunk are you using? I faced similar issue in advanced settings in 6.4 which later worked on 6.5

Re: savedsearch not returing more than 10000 results

nilbak1 — Tue, 20 Nov 2018 16:19:44 GMT

We are using splunk 7.0.3

Re: savedsearch not returing more than 10000 results

myriadic — Tue, 20 Nov 2018 20:04:55 GMT

when you set "action.email.maxresults", in the conf file, did you restart splunk after doing so? also, that parameter is available, in the GUI, under "advanced settings/edit" for that search

Re: savedsearch not returing more than 10000 results

nilbak1 — Wed, 21 Nov 2018 04:50:21 GMT

Yes, i am aware of that parameter is available in GUI under advance settings for that search.
If we change this setting from here, does splunk requires restart ?

Re: savedsearch not returing more than 10000 results

woodcock — Tue, 27 Nov 2018 00:01:12 GMT

We need WAY more detail. What "didn't work"? What is your search SPL?