Splunk Search

How to change setting for saved searches maxing out at 50k results?

jpfrancetic
Path Finder

Hi Splunk Community,

I am having a problem with saved searches not saving the full results. I have a saved search that is supposed to be saving ~100k results. When I go to the saved searches tab and manually click run, it saves all 100k results. When it runs on its schedule, it only saves 50k. 

Is there a setting I need to change in order for it to save all results?

Thanks in advance!

Labels (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Are you sure that the search has access to the same relevant knowledge objects when run as both users - the scheduled one and your ad-hoc search user?

Does your user have defined search filters?

Do you have the same index access rights as the user the search is scheduled with?

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Hi
Can you share your search?
0 Karma
Get Updates on the Splunk Community!

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to Officially Supported Splunk ...