I have 2 scheduled searches that run each morning. When I run them manually, 60k results are returned and output to their own CSV. When they run on their own each morning (according to the specifed time), exactly 50,000 results are returned and output to their CSVs.
Where should I look to investigate and find the source of this issue?
You will need to modify the dispatch.max_count parameter in the savedsearches.conf stanza for your search. By default, its set to 50,000 according to the docs: https://docs.splunk.com/Documentation/Splunk/7.2.4/Admin/Savedsearchesconf
dispatch.max_count = <integer> * The maximum number of results before finalizing the search. * Defaults to 500000.
As @pkeenan87 described, go to:
Searches, reports, and alerts, search for your saved search, then select
Advanced edit -> search for
dispatch.max_count and set it to