When creating an alert that creates a .csv file to be emailed , the .csv contains 9000 with an error.

[SamHTexas]

When creating an alert that creates a .csv file to be emailed , the .csv contains 9000 with an error that only the first 9000 of the 40,000 results are included. Please advise.

[s2_splunk · Accepted solution]

There is a setting in the alerting search (savedsearches.conf) called 

action.email.maxresults

The default is 10000, not sure why you are getting 9000, maybe it was overwritten. 

But that's where I would look first.

[SamHTexas]

Please tell me where do I find this savedsearches.conf file. Which server is it on?

[s2_splunk]

(Saved) searches are initiated on the Search Head;  you should find it there.

You can also see the settings in effect in the UI under Settings->Searches, reports, and alerts if you select "Advanced Edit" from the dropdown for the relevant alerting search: