Reporting

csv result limits at 50000 events for ad-hoc sendemail command

mchang_splunk
Splunk Employee
Splunk Employee

I have tried increase max_result by referring to
https://answers.splunk.com/answers/542862/how-to-overcome-csv-max-results-to-email.html

However, when I do ad-hoc search sending out email, the results are still limited at 50000 events:
sourcetype=foo | sendemail to=foo@foo.com sendcsv=true subject="more than 50000 events"

What else should I do to increase the limit?

0 Karma
1 Solution

mchang_splunk
Splunk Employee
Splunk Employee

The limit is defined in command.conf.
However, you can either increase this value by assigning maxinputs

sourcetype=foo | sendemail to=foo@foo.com sendcsv=true subject="more than 50000 events" maxinputs=500000

OR

permanently increase default maxinputs value in command.conf:

# maximum data that can be passed to command (0 = no limit)
maxinputs = 500000

View solution in original post

0 Karma

mchang_splunk
Splunk Employee
Splunk Employee

The limit is defined in command.conf.
However, you can either increase this value by assigning maxinputs

sourcetype=foo | sendemail to=foo@foo.com sendcsv=true subject="more than 50000 events" maxinputs=500000

OR

permanently increase default maxinputs value in command.conf:

# maximum data that can be passed to command (0 = no limit)
maxinputs = 500000
0 Karma
Get Updates on the Splunk Community!

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

[Puzzles] Solve, Learn, Repeat: Nested loops in Event Conversion

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...