Alert is not triggered via email.
I have a search that returns more event count (apprx more than 10k for 6hrs)which is affecting the default value setting responsible for email trigger:I have created a summary index as well and to run the report once in a week still the email is not being triggered because of huge event count.
Below is the option i have got to modify the default values:
$SPLUNK_HOME/etc/system/local/limits.conf
[scheduler]
max_action_results = 175000
[searchresults]
maxresultrows = 175000
$SPLUNK_HOME/etc/system/local/alert_actions.conf
[default]
maxresults = 175000
this enables an email alert containg a .csv to have 175k rows
Is there any other option other than above,as it is not recommened to change my default value in our infra so that we can send the report via email?
