Splunk Search

Is there a way to increase the results limit of saved searches per app?

ddrillic
Ultra Champion

We reached the limit of 500K results per saved search. We wonder if we can increase to, let's say 10 million, for one specific app.

We see Is there a setting for the maximum number of results that can be written to a summary index from a s...

But it doesn't refer to one specific app.

Tags (2)
0 Karma
1 Solution

abhishekreddy
Explorer

Change the dispatch.max_count in savedsearches.conf and place it in $SPLUNK_HOME/etc/apps/appName/local

View solution in original post

abhishekreddy
Explorer

Change the dispatch.max_count in savedsearches.conf and place it in $SPLUNK_HOME/etc/apps/appName/local

ddrillic
Ultra Champion

Great! on the search heads, right? sanity check ; -)

0 Karma

abhishekreddy
Explorer

Obviously 😛

0 Karma

ddrillic
Ultra Champion

; - ) interestingly, the following Why are only 10,000 events making it into the summary index?

says -

-- ALSO, in etc/system/local/limits.conf (create it if it doesn't exist), under the [scheduler] stanza, set max_action_results=100000 (or a limit of your choosing).

Not sure if it's applicable ...

0 Karma

ddrillic
Ultra Champion

Not much luck so far -

alt text

![alt text][2]

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...