Stop email truncate?

[freitagb]

I have a saved search that's running properly and alerts being sent at the appropriate times, but unfortunately the data being sent in email is truncated; hence the message in the email:

NOTE: Search results in this email might have been truncated. Please visit the search job page to view the full resultset

Is there a way to overcome this limitation?

[gkanapathy · Accepted solution]

The maximum is 10000 by default. I would ask you to think very hard about whether you really want a file with more than 10000 items sent to you, and what use you would make of such a file (that might not be better done by fetching the results directly from Splunk). Nevertheless, you can change the limit by setting action.email.maxresults under the saved search's settings in savedsearches.conf.

http://docs.splunk.com/Documentation/Splunk/latest/admin/savedsearchesconf

[kearaspoor]

If your output is greater than 50,000 rows, the above change to savedsearches.conf may also need to be paired with a change to limits.conf stanza:

max_action_results =
* The maximum number of results to load when triggering an alert action.
* Defaults to 50000

http://docs.splunk.com/Documentation/Splunk/6.4.2/Admin/Limitsconf

I'd also strongly suggest only making changes to this stanza with excessive caution since it's a global setting that's not restricted per-search.