Alerting

How to send alert search results as an email CSV attachment for more than 10,000 events?

nawneel
Communicator

Hi

I would like to send more than hundred thousand (100,000) events as a CSV attachment to email. When I fire this search with this requirement, I get a message in email as Only the first 10000 of 123968 results are included in the attached csv. I have tried changing the configuration file at $Splunk_Home\etc\system\local\alert_action.conf with [default] maxresults=10000 to maxresults=100000, but all in vain.

People to whom I will send this report are not supposed to access the Splunk Server, so am email attachment is only option for now.

Thanks in advance

1 Solution

somesoni2
Revered Legend

You can increase the limit by updating following attribute in alert_actions.conf file

[email]
maxresults = 100000

View solution in original post

rphillips_splk
Splunk Employee
Splunk Employee

After playing around with this I was able to get over the 10k or 50k results. This required all 3 settings on the search head.

$SPLUNK_HOME/etc/system/local/limits.conf
[scheduler]
max_action_results = 175000

[searchresults]
maxresultrows = 175000

$SPLUNK_HOME/etc/system/local/alert_actions.conf

[default]
maxresults = 175000

this enables an email alert containg a .csv to have 175k rows

Note: When I pushed the same configs from deployer and they ended up in an app/default as it should, but my .csv was limited to 10k rows.. when i put it straight on $SPLUNK_HOME/etc/system/local via cli on each member I got 175k rows in the csv

0 Karma

somesoni2
Revered Legend

You can increase the limit by updating following attribute in alert_actions.conf file

[email]
maxresults = 100000

nawneel
Communicator

[default]
maxresults=100000
[email]
command = $action.email.preprocess_results{default=""}$ | sendemail "results_link=$results.url$" "ssname=$name$" "graceful=$graceful{default=True}$" "trigger_time=$trigger_time$" maxinputs="$action.email.maxresults{default=100000}$" maxtime="$action.email.maxtime{default=5m}$" results_file="$results.file$"

i have provided following changes , now i am facing a limit of 50000 records in my csv attachment

0 Karma

angajalaprabhu
New Member

I'm facing the same issue. Did any one overcome the limit of 50k.
I need to create an alert to send 250,000 records in the CSV attachment.

0 Karma

hkgserverteam
Engager

Hi , Did you get around the 50,000 record limit?

0 Karma

nawneel
Communicator

@hkgserverteam i am still facing this issue. did u resolve this 50000 record limit?

0 Karma

nawneel
Communicator

@hkgserverteam are you still facing issue. yeah i have made to 50000 record limits

0 Karma

somesoni2
Revered Legend

Did you restart/refresh after making this change? What version of Splunk you have?

nawneel
Communicator

yes @somesoni2 i did make changes and restarted it , dint work

0 Karma
Get Updates on the Splunk Community!

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...