I would like to know if there's any way to change the default value of the "Results per page" option from 10 to a different number in the search results window? I have a search that can potentially return more than 50 events/results in a table format (50 being the max value for the Results per page option). I am running this search as a saved search and scheduling it to email a pdf attachment of the results. I noticed that in the current setup I am only seeing 10 results in the pdf attachment and the rest of the results are not accessible. I would like to know how to get around this issue.
yannk,nick - Thank you for the info.
A simple method is to setup it once, and it will be conserved in your coockies.
One method is to do a copy of flashtime.xml from
$SPLUNK_HOME/etc/apps/search/default/data/ui/views/flashtimeline.xml to $SPLUNK_HOME/etc/apps/search/local/data/ui/views/flashtimeline.xml
then change the line Selected to the correct value 10 10 20 20 50 True 50
unfortunately the viewstate preferences of all the individual users will override the XML's default value. So as an admin you could go and find and annihilate a bunch of viewstate stanzas sprayed across the user directories but it's hard.