Search code examples
splunksplunk-query

Export Splunk result 15000 output mail in CSV

My Splunk result set is giving output of 15000 record (sometimes more then that) but when I set query as an alert to send the result set in CSV file the result is getting limit to 10001 records only. Can anyone help that how can I get all 15000 record in CSV file in a mail via alert setup.

Solution

  • You have to edit and modify limits configuration :

    edit : $SPLUNK_HOME/etc/system/local/limits.conf

    [scheduler]
max_action_results = 20000
[searchresults]
maxresultrows = 20000</code>

    edit : $SPLUNK_HOME/etc/system/local/alert_actions.conf

    [default]
maxresults = 20000</code>