i have max results of 300000 in a report.But my shc is failing to send csv in a email. Please find the below settings.I tride to changed them to 300000 still its not working. Also i restarted after the change,
Fyi:the report containing lesser then 175000 they are working perfectly fine.
Can some one help me with this?
$SPLUNK_HOME/etc/system/local/limits.conf
[scheduler]
max_action_results = 175000
[searchresults]
maxresultrows = 175000
$SPLUNK_HOME/etc/system/local/alert_actions.conf
[default]
maxresults = 175000
You're on the right track with maxresults in alert_actions.conf but also need to update savedsearches.conf. You can control results there per search, or globally using [default].
savedsearches.conf
action.email.maxresults = <integer>
* Set the maximum number of results to be emailed.
* Any alert-level results threshold greater than this number will be capped at
this level.
* This value affects all methods of result inclusion by email alert: inline,
CSV and PDF.
* Note that this setting is affected globally by "maxresults" in the [email]
stanza of alert_actions.conf.
* Defaults to 10000