Splunk Search

How to change setting for saved searches maxing out at 50k results?

jpfrancetic
Path Finder

Hi Splunk Community,

I am having a problem with saved searches not saving the full results. I have a saved search that is supposed to be saving ~100k results. When I go to the saved searches tab and manually click run, it saves all 100k results. When it runs on its schedule, it only saves 50k. 

Is there a setting I need to change in order for it to save all results?

Thanks in advance!

Labels (3)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Are you sure that the search has access to the same relevant knowledge objects when run as both users - the scheduled one and your ad-hoc search user?

Does your user have defined search filters?

Do you have the same index access rights as the user the search is scheduled with?

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Hi
Can you share your search?
0 Karma
Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...