Export Splunk result 15000 output mail in CSV

0
votes

My Splunk result set is giving output of 15000 record (sometimes more then that) but when I set query as an alert to send the result set in CSV file the result is getting limit to 10001 records only. Can anyone help that how can I get all 15000 record in CSV file in a mail via alert setup.

1
splunksplunk-query

1 Answers

0
votes

You have to edit and modify limits configuration :

edit : $SPLUNK_HOME/etc/system/local/limits.conf

[scheduler]
max_action_results = 20000
[searchresults]
maxresultrows = 20000</code>

edit : $SPLUNK_HOME/etc/system/local/alert_actions.conf

[default]
maxresults = 20000</code>