Splunk Search

Is there a way to increase the results limit of saved searches per app?

ddrillic
Ultra Champion

We reached the limit of 500K results per saved search. We wonder if we can increase to, let's say 10 million, for one specific app.

We see Is there a setting for the maximum number of results that can be written to a summary index from a s...

But it doesn't refer to one specific app.

Tags (2)
0 Karma
1 Solution

abhishekreddy
Explorer

Change the dispatch.max_count in savedsearches.conf and place it in $SPLUNK_HOME/etc/apps/appName/local

View solution in original post

abhishekreddy
Explorer

Change the dispatch.max_count in savedsearches.conf and place it in $SPLUNK_HOME/etc/apps/appName/local

View solution in original post

ddrillic
Ultra Champion

Great! on the search heads, right? sanity check ; -)

0 Karma

abhishekreddy
Explorer

Obviously 😛

0 Karma

ddrillic
Ultra Champion

; - ) interestingly, the following Why are only 10,000 events making it into the summary index?

says -

-- ALSO, in etc/system/local/limits.conf (create it if it doesn't exist), under the [scheduler] stanza, set max_action_results=100000 (or a limit of your choosing).

Not sure if it's applicable ...

0 Karma

ddrillic
Ultra Champion

Not much luck so far -

alt text

![alt text][2]

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!