Splunk Search

Is there a way to increase the results limit of saved searches per app?

ddrillic
Ultra Champion

We reached the limit of 500K results per saved search. We wonder if we can increase to, let's say 10 million, for one specific app.

We see Is there a setting for the maximum number of results that can be written to a summary index from a s...

But it doesn't refer to one specific app.

Tags (2)
0 Karma
1 Solution

abhishekreddy
Explorer

Change the dispatch.max_count in savedsearches.conf and place it in $SPLUNK_HOME/etc/apps/appName/local

View solution in original post

abhishekreddy
Explorer

Change the dispatch.max_count in savedsearches.conf and place it in $SPLUNK_HOME/etc/apps/appName/local

ddrillic
Ultra Champion

Great! on the search heads, right? sanity check ; -)

0 Karma

abhishekreddy
Explorer

Obviously 😛

0 Karma

ddrillic
Ultra Champion

; - ) interestingly, the following Why are only 10,000 events making it into the summary index?

says -

-- ALSO, in etc/system/local/limits.conf (create it if it doesn't exist), under the [scheduler] stanza, set max_action_results=100000 (or a limit of your choosing).

Not sure if it's applicable ...

0 Karma

ddrillic
Ultra Champion

Not much luck so far -

alt text

![alt text][2]

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...