When creating an alert that creates a .csv file to be emailed , the .csv contains 9000 with an error that only the first 9000 of the 40,000 results are included. Please advise.
There is a setting in the alerting search (savedsearches.conf) called
action.email.maxresults
The default is 10000, not sure why you are getting 9000, maybe it was overwritten.
But that's where I would look first.
There is a setting in the alerting search (savedsearches.conf) called
action.email.maxresults
The default is 10000, not sure why you are getting 9000, maybe it was overwritten.
But that's where I would look first.
Please tell me where do I find this savedsearches.conf file. Which server is it on?
(Saved) searches are initiated on the Search Head; you should find it there.
You can also see the settings in effect in the UI under Settings->Searches, reports, and alerts if you select "Advanced Edit" from the dropdown for the relevant alerting search: