Splunk Search

How to set up a limit to max no of events to be searched

tmuthuk
Path Finder

Is there anyway to restrict the max no of events to be searched in an index irrespective of the time chosen the time picker ?

Example : i have 100000 events in a index. But i want the queries executed by users to search only latest 50000 records , irrespective the of the time chosen by the user

Tags (3)

somesoni2
SplunkTrust
SplunkTrust

There is not way to limit the no of events returned by a search, by applying implicit restriction.

For specific searches, you can use "| head X" to limit the no of rows to latest 'X' results, but this is just that particular search level, not the user level or global.

Other restriction that you can apply to limit the no of rows accessed by users is by limiting the time window that they can use. This can be done at Role level (from Splunk UI-> Access Controls -> Roles -> Restrict search time range (value in second), from authorize.conf file in $SPLUNK_HOME/etc/system/local (create if not exists -> Under specific Role -> srchTimeWin stanza)

tmuthuk
Path Finder

Thanks for your reply.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

No, but there is a way to limit the max time range a user can select in the role configuration parameters, which should have a similar effect.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

The setting on on the role definition manager screen.

0 Karma

tmuthuk
Path Finder

Thanks for your Reply .

Could you please explain me how could we set the maximum time range ?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...