Installation

Report not exporting all events

snigdhasaxena
Communicator

When search query for report is run in Splunk, it shows 15000 events for last 7 days (example 4/14-4/21) but when I export results in csv, it exports events only for 4/21.
I have reset dispatch.max_count to 0 but still it doesn't retrieve all events in csv when report runs.

Tags (1)
0 Karma

manjunathmeti
Champion

Go to Settings >> Searches, Reports, and Alerts.

Find and click on report name and check Earliest time and Latest time. Set these if not set directly the query.

0 Karma

snigdhasaxena
Communicator

I tried but still not all events are exported in csv

0 Karma

manjunathmeti
Champion

How are you exporting? Is it some alert action?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...