How to send alert search results as an email CSV attachment for more than 10,000 events?

[nawneel]

Hi

I would like to send more than hundred thousand (100,000) events as a CSV attachment to email. When I fire this search with this requirement, I get a message in email as Only the first 10000 of 123968 results are included in the attached csv. I have tried changing the configuration file at $Splunk_Home\etc\system\local\alert_action.conf with [default] maxresults=10000 to maxresults=100000, but all in vain.

People to whom I will send this report are not supposed to access the Splunk Server, so am email attachment is only option for now.

Thanks in advance

[rphillips_splk]

After playing around with this I was able to get over the 10k or 50k results. This required all 3 settings on the search head.

$SPLUNK_HOME/etc/system/local/limits.conf
[scheduler]
max_action_results = 175000

[searchresults]
maxresultrows = 175000

$SPLUNK_HOME/etc/system/local/alert_actions.conf

[default]
maxresults = 175000

this enables an email alert containg a .csv to have 175k rows

Note: When I pushed the same configs from deployer and they ended up in an app/default as it should, but my .csv was limited to 10k rows.. when i put it straight on $SPLUNK_HOME/etc/system/local via cli on each member I got 175k rows in the csv

[somesoni2 · Accepted solution]

You can increase the limit by updating following attribute in alert_actions.conf file

[email]
maxresults = 100000

[nawneel]

[default]
maxresults=100000
[email]
command = $action.email.preprocess_results{default=""}$ | sendemail "results_link=$results.url$" "ssname=$name$" "graceful=$graceful{default=True}$" "trigger_time=$trigger_time$" maxinputs="$action.email.maxresults{default=100000}$" maxtime="$action.email.maxtime{default=5m}$" results_file="$results.file$"

i have provided following changes , now i am facing a limit of 50000 records in my csv attachment

[angajalaprabhu]

I'm facing the same issue. Did any one overcome the limit of 50k.
I need to create an alert to send 250,000 records in the CSV attachment.

[hkgserverteam]

Hi , Did you get around the 50,000 record limit?

[nawneel]

@hkgserverteam i am still facing this issue. did u resolve this 50000 record limit?

[nawneel]

@hkgserverteam are you still facing issue. yeah i have made to 50000 record limits

[somesoni2]

Did you restart/refresh after making this change? What version of Splunk you have?

[nawneel]

yes @somesoni2 i did make changes and restarted it , dint work