Saved Search only return 1000 rows

[splunkgam]

When a saved search sends an email with the results in a CSV file, the file never contains more than 1000 lines (plus the header line). How can I change this behavior to contain all the results found in the search, for instance 12000. When I run the same exact search manually in splunk, it returns 12000 rows, but the file will only contain 1000.

[Ayn]

You should be able to modify the default limit of 1000 events by setting another value for maxresults in alert_actions.conf. See this question: http://splunk-base.splunk.com/answers/7544/splunk-alert-only-includes-first-1000-results-of-search-w...

[splunkgam]

Updating both default and local alert_actions.conf did not change the behavior. I did notice in the link you provided that one of the posters thought it might be because they were using 4.1.5 and that may have been part of the problem. We are using 4.1.4.