Archive
Highlighted

Is there a way to increase the results limit of saved searches per app?

Ultra Champion

We reached the limit of 500K results per saved search. We wonder if we can increase to, let's say 10 million, for one specific app.

We see Is there a setting for the maximum number of results that can be written to a summary index from a s...

But it doesn't refer to one specific app.

Tags (2)
0 Karma
Highlighted

Re: Is there a way to increase the results limit of saved searches per app?

Explorer

Change the dispatch.max_count in savedsearches.conf and place it in $SPLUNK_HOME/etc/apps/appName/local

View solution in original post

Highlighted

Re: Is there a way to increase the results limit of saved searches per app?

Ultra Champion

Great! on the search heads, right? sanity check ; -)

0 Karma
Highlighted

Re: Is there a way to increase the results limit of saved searches per app?

Explorer

Obviously 😛

0 Karma
Highlighted

Re: Is there a way to increase the results limit of saved searches per app?

Ultra Champion

; - ) interestingly, the following Why are only 10,000 events making it into the summary index?

says -

-- ALSO, in etc/system/local/limits.conf (create it if it doesn't exist), under the [scheduler] stanza, set maxactionresults=100000 (or a limit of your choosing).

Not sure if it's applicable ...

0 Karma
Highlighted

Re: Is there a way to increase the results limit of saved searches per app?

Ultra Champion

Not much luck so far -

alt text

![alt text][2]

0 Karma