Can we limit how many results are output to a CSV in a scheduled search?

[russell120]

Hi,

I have 2 scheduled searches that run each morning. When I run them manually, 60k results are returned and output to their own CSV. When they run on their own each morning (according to the specifed time), exactly 50,000 results are returned and output to their CSVs.

Where should I look to investigate and find the source of this issue?

[woodcock]

As @pkeenan87 described, go to:

Select Settings -> Searches, reports, and alerts, search for your saved search, then select Edit -> Advanced edit -> search for dispatch.max_count and set it to 0 for unlimited.

[pkeenan87]

You will need to modify the dispatch.max_count parameter in the savedsearches.conf stanza for your search. By default, its set to 50,000 according to the docs: https://docs.splunk.com/Documentation/Splunk/7.2.4/Admin/Savedsearchesconf

dispatch.max_count = <integer>
* The maximum number of results before finalizing the search.
* Defaults to 500000.

[harsmarvania57]

Hi,

Have a look at this https://answers.splunk.com/answers/542862/how-to-overcome-csv-max-results-to-email.html