Getting Data In

Can we limit how many results are output to a CSV in a scheduled search?

russell120
Communicator

Hi,

I have 2 scheduled searches that run each morning. When I run them manually, 60k results are returned and output to their own CSV. When they run on their own each morning (according to the specifed time), exactly 50,000 results are returned and output to their CSVs.

Where should I look to investigate and find the source of this issue?

0 Karma

woodcock
Esteemed Legend

As @pkeenan87 described, go to:

Select Settings -> Searches, reports, and alerts, search for your saved search, then select Edit -> Advanced edit -> search for dispatch.max_count and set it to 0 for unlimited.

pkeenan87
Communicator

You will need to modify the dispatch.max_count parameter in the savedsearches.conf stanza for your search. By default, its set to 50,000 according to the docs: https://docs.splunk.com/Documentation/Splunk/7.2.4/Admin/Savedsearchesconf

dispatch.max_count = <integer>
* The maximum number of results before finalizing the search.
* Defaults to 500000.

harsmarvania57
SplunkTrust
SplunkTrust
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...