Getting Data In
Highlighted

Can we limit how many results are output to a CSV in a scheduled search?

Communicator

Hi,

I have 2 scheduled searches that run each morning. When I run them manually, 60k results are returned and output to their own CSV. When they run on their own each morning (according to the specifed time), exactly 50,000 results are returned and output to their CSVs.

Where should I look to investigate and find the source of this issue?

0 Karma
Highlighted

Re: Can we limit how many results are output to a CSV in a scheduled search?

SplunkTrust
SplunkTrust
0 Karma
Highlighted

Re: Can we limit how many results are output to a CSV in a scheduled search?

Communicator

You will need to modify the dispatch.max_count parameter in the savedsearches.conf stanza for your search. By default, its set to 50,000 according to the docs: https://docs.splunk.com/Documentation/Splunk/7.2.4/Admin/Savedsearchesconf

dispatch.max_count = <integer>
* The maximum number of results before finalizing the search.
* Defaults to 500000.
Highlighted

Re: Can we limit how many results are output to a CSV in a scheduled search?

Esteemed Legend

As @pkeenan87 described, go to:

Select Settings -> Searches, reports, and alerts, search for your saved search, then select Edit -> Advanced edit -> search for dispatch.max_count and set it to 0 for unlimited.