Hi Splukers ,
We have scheduled a report into get an email with CSV attachment for the everyday 6 AM.
My report is giving around 500000 records when i am running reporting manually into the Splunk server, as well as I am able to see all the records into .text format. However, the scheduled file i got into the mail is 50001 only.
I have already done all the necessary changes in/home/splunk/etc/system/local/limits.conf like below:
[scheduler]
max_action_results=100000000
[searchresults]
maxresultrows=100000000
As well $SPLUNK_HOME/etc/system/local/alert_actions.conf
[default]
maxresults = 100000000
Saved search for that report is already created so we have change the configuration in savedsearches.conf as well :
action.email.maxresults=100000000
After all the changes, we restarted the servers but still we are not getting all records into the email.
Please Suggest!!
Thanks
RJ
Hi Splunkers,
we had find the solution for this thread.we have to add dispatch.max_count=10000000 in savedsearches.conf file under the index.Now we are getting 10000000 records in Email.
By Default dispatch.max_count is 50000.
Cheers!!
Hi Splunkers,
we had find the solution for this thread.we have to add dispatch.max_count=10000000 in savedsearches.conf file under the index.Now we are getting 10000000 records in Email.
By Default dispatch.max_count is 50000.
Cheers!!
Hello @rohitvjoshi,
I found this similar question: How to overcome CSV max results to email?
Check out the accepted answer. Try the following change (and restart Splunk afterwards):
$SPLUNK_HOME/etc/system/local/alert_actions.conf
[default]
maxresults = 100000000
Thanks for your response!
we have already configured this configuration still we are not getting expected results.
we have to apply these changes in Search Head or Indexers.
I believe you have to apply it on the Search Head.
Yeah , I have applied these configurations in Search Head but still not working.
My Cluster do not have Minimum Hardware as recommended by Splunk , Is there any impact of hardware on this ??
Thanks In advance!