Is there a way to increase the results limit of saved searches per app?

[ddrillic]

We reached the limit of 500K results per saved search. We wonder if we can increase to, let's say 10 million, for one specific app.

We see Is there a setting for the maximum number of results that can be written to a summary index from a s...

But it doesn't refer to one specific app.

[abhishekreddy · Accepted solution]

Change the dispatch.max_count in savedsearches.conf and place it in $SPLUNK_HOME/etc/apps/appName/local

[ddrillic]

Great! on the search heads, right? sanity check ; -)

[abhishekreddy]

Obviously 😛

[ddrillic]

; - ) interestingly, the following Why are only 10,000 events making it into the summary index?

says -

-- ALSO, in etc/system/local/limits.conf (create it if it doesn't exist), under the [scheduler] stanza, set max_action_results=100000 (or a limit of your choosing).

Not sure if it's applicable ...

[ddrillic]

Not much luck so far -