Hi Splunk Community,
I am having a problem with saved searches not saving the full results. I have a saved search that is supposed to be saving ~100k results. When I go to the saved searches tab and manually click run, it saves all 100k results. When it runs on its schedule, it only saves 50k.
Is there a setting I need to change in order for it to save all results?
Thanks in advance!
Are you sure that the search has access to the same relevant knowledge objects when run as both users - the scheduled one and your ad-hoc search user?
Does your user have defined search filters?
Do you have the same index access rights as the user the search is scheduled with?