Reporting

csv result limits at 50000 events for ad-hoc sendemail command

mchang_splunk
Splunk Employee
Splunk Employee

I have tried increase max_result by referring to
https://answers.splunk.com/answers/542862/how-to-overcome-csv-max-results-to-email.html

However, when I do ad-hoc search sending out email, the results are still limited at 50000 events:
sourcetype=foo | sendemail to=foo@foo.com sendcsv=true subject="more than 50000 events"

What else should I do to increase the limit?

0 Karma
1 Solution

mchang_splunk
Splunk Employee
Splunk Employee

The limit is defined in command.conf.
However, you can either increase this value by assigning maxinputs

sourcetype=foo | sendemail to=foo@foo.com sendcsv=true subject="more than 50000 events" maxinputs=500000

OR

permanently increase default maxinputs value in command.conf:

# maximum data that can be passed to command (0 = no limit)
maxinputs = 500000

View solution in original post

0 Karma

mchang_splunk
Splunk Employee
Splunk Employee

The limit is defined in command.conf.
However, you can either increase this value by assigning maxinputs

sourcetype=foo | sendemail to=foo@foo.com sendcsv=true subject="more than 50000 events" maxinputs=500000

OR

permanently increase default maxinputs value in command.conf:

# maximum data that can be passed to command (0 = no limit)
maxinputs = 500000
0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...