i have created a report and scheduled it. i have added my email address to get result in csv format. but when the count of result rows are greater than 10000, only first 10000 rows are present in csv file. i want all data (more than 10000 rows) in my csv file. is there any way to resolve this?
you can change it either from
UI
Alert -> Edit -> Advanced Edit ->action.email.maxresults
Conf File
savedsearches.conf
action.email.maxresults =
some part is solved by your solution @renjith_nair , thank you for that! but now i'm getting only 50000 rows of data in csv file when i gave limit as 1000000. what to do now?
Glad that the initial problem is fixed.
Please have a look at this - https://community.splunk.com/t5/Getting-Data-In/How-to-overcome-CSV-max-results-to-email/td-p/319484