Security

Notable action "for each result" limits to 250 (or 500)- How do I see all?

rookiemonster
Splunk Employee
Splunk Employee

When I generate notable "for each result" the max number of notables is 250 or 500

I want all results to produce an notable

Labels (1)
0 Karma
1 Solution

rookiemonster
Splunk Employee
Splunk Employee

max_per_result_alerts

On prem: https://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf

max_per_result_alerts = <integer>
* Maximum number of alerts to trigger for each saved search instance (or
  real-time results preview for RT alerts)
* Only applies in non-digest mode alerting. Use 0 to disable this limit
* Default: 500

 

Cloud: https://docs.splunk.com/Documentation/SplunkCloud/9.0.2209/Config/ManageLimits

max_per_result_alertsMaximum number of alerts to trigger for each saved search instance (or real-time results preview for RT alerts). Only applies in non-digest mode alerting."minValue": 250

"maxValue": 5000
"defaultValue": 500

 

 

lrh

View solution in original post

0 Karma

rookiemonster
Splunk Employee
Splunk Employee

max_per_result_alerts

On prem: https://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf

max_per_result_alerts = <integer>
* Maximum number of alerts to trigger for each saved search instance (or
  real-time results preview for RT alerts)
* Only applies in non-digest mode alerting. Use 0 to disable this limit
* Default: 500

 

Cloud: https://docs.splunk.com/Documentation/SplunkCloud/9.0.2209/Config/ManageLimits

max_per_result_alertsMaximum number of alerts to trigger for each saved search instance (or real-time results preview for RT alerts). Only applies in non-digest mode alerting."minValue": 250

"maxValue": 5000
"defaultValue": 500

 

 

lrh

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...