"Only the first 10000 of 11409 results are included in the attached CSV" Are results truncated after the report is complete?

[babcolee]

We received the message "Only the first 10000 of 11409 results are included in the attached csv". Does the application stop running after the first 10,000 events are found? Or, does it run until finished and then trim the report?

[rakesh007]

Even I have the same issues. I made the below changes on alert_actions.conf file. Please anyone help me on this...

[default]
maxresults=100000

[email]
command     = $action.email.preprocess_results{default=""}$ | sendemail "results_link=$results.url$" "ssname=$name$" "graceful=$graceful{default=True}$" "trigger_time=$trigger_time$" maxinputs="$action.email.maxresults{default=100000}$" maxtime="$action.email.maxtime{default=5m}$" results_file="$results.file$"
lisplunk@ifm0187:/opt/li/splunk/etc/apps/LI_miscSettings/default>

[vince2010091]

[email]
maxresults = 100000

[somesoni2]

The output of the subsearch is truncated to 10,000 events, after subsearch execution is complete

[FritzWittwer_ol]

and in case you are using a sort, this has also a default limit of 10'000 events