Getting Data In

Why am I unable to fetch more then 1000000 records via a scheduled report from Splunk to email in a CSV?

rohitvjoshi
Path Finder

Hi Splukers ,

We have scheduled a report into get an email with CSV attachment for the everyday 6 AM.

My report is giving around 500000 records when i am running reporting manually into the Splunk server, as well as I am able to see all the records into .text format. However, the scheduled file i got into the mail is 50001 only.

I have already done all the necessary changes in/home/splunk/etc/system/local/limits.conf like below:

[scheduler]
max_action_results=100000000

[searchresults]
maxresultrows=100000000

As well $SPLUNK_HOME/etc/system/local/alert_actions.conf

[default]
maxresults = 100000000

Saved search for that report is already created so we have change the configuration in savedsearches.conf as well :

action.email.maxresults=100000000

After all the changes, we restarted the servers but still we are not getting all records into the email.

Please Suggest!!

Thanks
RJ

0 Karma
1 Solution

rohitvjoshi
Path Finder

Hi Splunkers,

we had find the solution for this thread.we have to add dispatch.max_count=10000000 in savedsearches.conf file under the index.Now we are getting 10000000 records in Email.

By Default dispatch.max_count is 50000.

Cheers!!

View solution in original post

0 Karma

rohitvjoshi
Path Finder

Hi Splunkers,

we had find the solution for this thread.we have to add dispatch.max_count=10000000 in savedsearches.conf file under the index.Now we are getting 10000000 records in Email.

By Default dispatch.max_count is 50000.

Cheers!!

0 Karma

whrg
Motivator

Hello @rohitvjoshi,

I found this similar question: How to overcome CSV max results to email?

Check out the accepted answer. Try the following change (and restart Splunk afterwards):

$SPLUNK_HOME/etc/system/local/alert_actions.conf
[default]
maxresults = 100000000

0 Karma

rohitvjoshi
Path Finder

Thanks for your response!

we have already configured this configuration still we are not getting expected results.
we have to apply these changes in Search Head or Indexers.

0 Karma

whrg
Motivator

I believe you have to apply it on the Search Head.

0 Karma

rohitvjoshi
Path Finder

Yeah , I have applied these configurations in Search Head but still not working.

My Cluster do not have Minimum Hardware as recommended by Splunk , Is there any impact of hardware on this ??

Thanks In advance!

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...