Reporting

Stop email truncate?

freitagb
Engager

I have a saved search that's running properly and alerts being sent at the appropriate times, but unfortunately the data being sent in email is truncated; hence the message in the email:

NOTE: Search results in this email might have been truncated. Please visit the search job page to view the full resultset

Is there a way to overcome this limitation?

Tags (3)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

The maximum is 10000 by default. I would ask you to think very hard about whether you really want a file with more than 10000 items sent to you, and what use you would make of such a file (that might not be better done by fetching the results directly from Splunk). Nevertheless, you can change the limit by setting action.email.maxresults under the saved search's settings in savedsearches.conf.

http://docs.splunk.com/Documentation/Splunk/latest/admin/savedsearchesconf

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

The maximum is 10000 by default. I would ask you to think very hard about whether you really want a file with more than 10000 items sent to you, and what use you would make of such a file (that might not be better done by fetching the results directly from Splunk). Nevertheless, you can change the limit by setting action.email.maxresults under the saved search's settings in savedsearches.conf.

http://docs.splunk.com/Documentation/Splunk/latest/admin/savedsearchesconf

kearaspoor
SplunkTrust
SplunkTrust

If your output is greater than 50,000 rows, the above change to savedsearches.conf may also need to be paired with a change to limits.conf stanza:

max_action_results =
* The maximum number of results to load when triggering an alert action.
* Defaults to 50000

http://docs.splunk.com/Documentation/Splunk/6.4.2/Admin/Limitsconf

I'd also strongly suggest only making changes to this stanza with excessive caution since it's a global setting that's not restricted per-search.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...