How do I get more than 10,000 results in the CSV file attached to a scheduled report email? is a good one. I ended up using the advanced edit to modify the action.email.maxresults configuration parameter, however, a colleague of mine who is not an admin doesn't have access to the advanced edit page. So, where do we grant access to the advanced edit page?
The email report says -
Only the first 100 of 300 results are included in the attached csv. Only the first 100 of 300 results are included below. View all results in Splunk.
So, if the user doesn't have access to Splunk, how can we do it?