topic Re: Why my Splunk alert only include 1000 results in attached csv? in Alerting

Why my Splunk alert only include 1000 results in attached csv?

mekamundia — Thu, 30 Oct 2014 10:21:32 GMT

Hi to all,
I am a real newbie in Splunk. Sorry for my simple question, but I really need help.
I have set an automated alert on Splunk that collects over 8000 results when triggered. I tried dispatch those results by email in a .csv document, but Splunk only attach first 1000 results to the file. Vice versa when I relaunched the search manually, it made easily a complete csv document.
How I can extend the number of results in mail attachment ?
I also read the topic Splunk Alert only includes first 1000 results of search. Why? but it seems to me does not gave a solution to this problem: (there seems to be some hard-coded voodoo going on behind the scenes. And for whatever reason, that voodoo wants to keep your from sending more than 1,000 events in your email)
thanks in advance for every tip

Re: Why my Splunk alert only include 1000 results in attached csv?

MuS — Thu, 30 Oct 2014 10:30:15 GMT

Hi mekamundia,

you can apply some anti-voodoo globally in alert_actions.conf by setting

[default]
maxinputs = <YourNewMaxResultNumber>

or per saved search/ alert in savedsearch.conf like this:

action.email.maxinputs = <YourNewMaxResultNumber>

Hope this helps to fight the Voodoo 😉

cheers, MuS

Re: Why my Splunk alert only include 1000 results in attached csv?

mekamundia — Fri, 31 Oct 2014 08:44:28 GMT

Hi MuS

Yesterday I have applied the modify to alert_actions. conf and restarted the search head (where the search is saved and runs).
But the wodoo remains :(...

What i missed?
I need some more tips !

cheers,
Mekamundia

Re: Why my Splunk alert only include 1000 results in attached csv?

MuS — Fri, 31 Oct 2014 08:47:03 GMT

Did you try the action.email.maxinputs in savedsearch.conf as well?

Re: Why my Splunk alert only include 1000 results in attached csv?

MuS — Fri, 31 Oct 2014 08:51:16 GMT

uuppsss, looks like the maxinputs belongs to the [default] stanza and not the [email] in alert_actions.conf - sorry my bad

Re: Why my Splunk alert only include 1000 results in attached csv?

mekamundia — Fri, 31 Oct 2014 08:54:49 GMT

Ok, I'll try again modifying [default] stanza.
The search runs at night: tomorrow i'llsee the results.

Thanks for your support !

Re: Why my Splunk alert only include 1000 results in attached csv?

mekamundia — Fri, 31 Oct 2014 16:53:55 GMT

I have tested the modify...
nothing new happened. The vodoo remains... 😞

Re: Why my Splunk alert only include 1000 results in attached csv?

somesoni2 — Fri, 31 Oct 2014 18:38:26 GMT

Try maxresults attribute in alert_actions.conf and action.email.maxresults in savedsearches.conf for your search

Re: Why my Splunk alert only include 1000 results in attached csv?

mekamundia — Thu, 06 Nov 2014 10:38:28 GMT

Nothing to do.... again.
Sorry somesoni2 but also your solution does not work.
I wait for new tips from everybody.

Re: Why my Splunk alert only include 1000 results in attached csv?

yannK — Wed, 19 Nov 2014 18:20:01 GMT

the limits are in 2 places :

in alert_actions maxresults=10000
in alert_actions in the command calling the email script.

you can redefine this in our local/alert_actions.conf

Here is a way to bump the limit to 50000 for the email alerts only. (on 6.2.0, please adapt the command to your version)

[email]
command     = $action.email.preprocess_results{default=""}$ | sendemail "results_link=$results.url$" "ssname=$name$" "graceful=$graceful{default=True}$" "trigger_time=$trigger_time$" maxinputs="$action.email.maxresults{default=50000}$" maxtime="$action.email.maxtime{default=5m}$" results_file="$results.file$"

maxresults=50000

Re: Why my Splunk alert only include 1000 results in attached csv?

jaxjohnny2000 — Thu, 18 Jul 2019 14:13:50 GMT

Using the Web GUI, modify just this one report you want to change. Try to go into Edit - Advanced Edit. The scroll down to action.email.maxresults . The default value is there for 10000. Add another zero (0) so it reads 100000.

Re: Why my Splunk alert only include 1000 results in attached csv?

andygerberkp — Tue, 30 Apr 2024 21:29:34 GMT

This is an ancient thread, but bears updating.

As of 9.1.x, this is what I see:

Default is 10K lines. You need to change it in alert_actions.conf. Any change there will propagate to "Advanced Edit" for a saved search; there is no need to change the value there.

If the mail doesn't come through, look through splunkd logs for "Message size exceeds fixed limit" as many mailers reject attachments larger than a given size (10M is typical)