Splunk Search

Saved Search only return 1000 rows

New Member

When a saved search sends an email with the results in a CSV file, the file never contains more than 1000 lines (plus the header line). How can I change this behavior to contain all the results found in the search, for instance 12000. When I run the same exact search manually in splunk, it returns 12000 rows, but the file will only contain 1000.

Tags (3)
0 Karma


You should be able to modify the default limit of 1000 events by setting another value for maxresults in alert_actions.conf. See this question: http://splunk-base.splunk.com/answers/7544/splunk-alert-only-includes-first-1000-results-of-search-w...

New Member

Updating both default and local alert_actions.conf did not change the behavior. I did notice in the link you provided that one of the posters thought it might be because they were using 4.1.5 and that may have been part of the problem. We are using 4.1.4.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...