I have changed action.email.maxresults for one of my savedsearch from 10000 to 100000 but that is not working and I don't want to set it globally in limits.conf and alert_actions.conf as mentioned in
https://answers.splunk.com/answers/542862/how-to-overcome-csv-max-results-to-email.html
as by doing this it will be for all jobs.
Can anyone suggest why this setting action.email.maxresults in savedsearches.conf didn't worked ?
We need WAY more detail. What "didn't work"? What is your search SPL?
when you set "action.email.maxresults", in the conf file, did you restart splunk after doing so? also, that parameter is available, in the GUI, under "advanced settings/edit" for that search
Yes, i am aware of that parameter is available in GUI under advance settings for that search.
If we change this setting from here, does splunk requires restart ?
What version of Splunk are you using? I faced similar issue in advanced settings in 6.4 which later worked on 6.5
We are using splunk 7.0.3
What is the search? If it has a sort
command in it that will limit the results.
Hi @richgallow
thanks for looking into it. Search I can't paste here, but its not using sort command
Run the btool command to see what settings are applied
./splunk btool savedsearches list YourSavedSearchNameHere --debug
[xxxxxxxxxxxxxxxxxxxxxxxx]
action.email = 1
action.email.include.results_link = 0
action.email.maxresults = 100000
action.email.sendcsv = 1
action.email.sendresults = 1
action.email.to = xxxxxxxxxxxxx
action.email.useNSSubject = 1
alert.track = 0
cron_schedule = 45 13 * * *
dispatch.earliest_time = -7d@d
dispatch.latest_time = @d