Getting Data In

Why am I unable to fetch more then 1000000 records via a scheduled report from Splunk to email in a CSV?

rohitvjoshi
Path Finder

Hi Splukers ,

We have scheduled a report into get an email with CSV attachment for the everyday 6 AM.

My report is giving around 500000 records when i am running reporting manually into the Splunk server, as well as I am able to see all the records into .text format. However, the scheduled file i got into the mail is 50001 only.

I have already done all the necessary changes in/home/splunk/etc/system/local/limits.conf like below:

[scheduler]
max_action_results=100000000

[searchresults]
maxresultrows=100000000

As well $SPLUNK_HOME/etc/system/local/alert_actions.conf

[default]
maxresults = 100000000

Saved search for that report is already created so we have change the configuration in savedsearches.conf as well :

action.email.maxresults=100000000

After all the changes, we restarted the servers but still we are not getting all records into the email.

Please Suggest!!

Thanks
RJ

0 Karma
1 Solution

rohitvjoshi
Path Finder

Hi Splunkers,

we had find the solution for this thread.we have to add dispatch.max_count=10000000 in savedsearches.conf file under the index.Now we are getting 10000000 records in Email.

By Default dispatch.max_count is 50000.

Cheers!!

View solution in original post

0 Karma

rohitvjoshi
Path Finder

Hi Splunkers,

we had find the solution for this thread.we have to add dispatch.max_count=10000000 in savedsearches.conf file under the index.Now we are getting 10000000 records in Email.

By Default dispatch.max_count is 50000.

Cheers!!

0 Karma

whrg
Motivator

Hello @rohitvjoshi,

I found this similar question: How to overcome CSV max results to email?

Check out the accepted answer. Try the following change (and restart Splunk afterwards):

$SPLUNK_HOME/etc/system/local/alert_actions.conf
[default]
maxresults = 100000000

0 Karma

rohitvjoshi
Path Finder

Thanks for your response!

we have already configured this configuration still we are not getting expected results.
we have to apply these changes in Search Head or Indexers.

0 Karma

whrg
Motivator

I believe you have to apply it on the Search Head.

0 Karma

rohitvjoshi
Path Finder

Yeah , I have applied these configurations in Search Head but still not working.

My Cluster do not have Minimum Hardware as recommended by Splunk , Is there any impact of hardware on this ??

Thanks In advance!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...