https://community.splunk.com/t5/Splunk-Enterprise/How-to-increase-the-number-of-results-in-quot-show-source-quot/m-p/646397#M16545 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/244498">@super_saiyan</a>,</P><P>&nbsp;</P><P>You can update limits.conf to change the Show Source settings.&nbsp; The docs mention that results are "pruned" so while you increase the limit, you may still not get an increase in events displayed.</P><P><A href="https://docs.splunk.com/Documentation/Splunk/latest/Admin/limitsconf#.5Bshow_source.5D" target="_self">https://docs.splunk.com/Documentation/Splunk/latest/Admin/limitsconf#.5Bshow_source.5D</A></P><LI-CODE lang="markup">[show_source] distributed = &lt;boolean&gt; * Whether or not a distributed search is performed to get events from all servers and indexes. * Turning this off results in better performance for show source, but events will only come from the initial server and index. * Default: true distributed_search_limit = &lt;unsigned integer&gt; * The maximum number of events that are requested when performing a search for distributed show source. * As this is used for a larger search than the initial non-distributed show source, it is larger than max_count * Splunk software rarely returns anywhere near this number of results, as excess results are pruned. * The point is to ensure the distributed search captures the target event in an environment with many events. * Default: 30000 max_count = &lt;integer&gt; * Maximum number of events accessible by show_source. * The show source command will fail when more than this many events are in the same second as the requested event. * Default: 10000 max_timeafter = &lt;timespan&gt; * Maximum time after requested event to show. * Default: '1day' (86400 seconds) max_timebefore = &lt;timespan&gt; * Maximum time before requested event to show. * Default: '1day' (86400 seconds)</LI-CODE><P>&nbsp;</P><P>Cheers,</P><P>Daniel</P> Fri, 09 Jun 2023 00:30:37 GMT danspav 2023-06-09T00:30:37Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-increase-the-number-of-results-in-quot-show-source-quot/m-p/646078#M16513 <P>How do i increase the Number of results in "<STRONG>show source" </STRONG>in Splunk to 10000. Now the maximum limit is 1000.<BR />Please refer to the screen print.</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="super_saiyan_0-1686132347782.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/25729iD824CAC04CFAF683/image-size/medium?v=v2&amp;px=400" role="button" title="super_saiyan_0-1686132347782.png" alt="super_saiyan_0-1686132347782.png" /></span></P> <P>&nbsp;</P> Wed, 07 Jun 2023 10:57:34 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-increase-the-number-of-results-in-quot-show-source-quot/m-p/646078#M16513 super_saiyan 2023-06-07T10:57:34Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-increase-the-number-of-results-in-quot-show-source-quot/m-p/646238#M16529 <P>any help ?</P> Thu, 08 Jun 2023 05:03:55 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-increase-the-number-of-results-in-quot-show-source-quot/m-p/646238#M16529 super_saiyan 2023-06-08T05:03:55Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-increase-the-number-of-results-in-quot-show-source-quot/m-p/646397#M16545 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/244498">@super_saiyan</a>,</P><P>&nbsp;</P><P>You can update limits.conf to change the Show Source settings.&nbsp; The docs mention that results are "pruned" so while you increase the limit, you may still not get an increase in events displayed.</P><P><A href="https://docs.splunk.com/Documentation/Splunk/latest/Admin/limitsconf#.5Bshow_source.5D" target="_self">https://docs.splunk.com/Documentation/Splunk/latest/Admin/limitsconf#.5Bshow_source.5D</A></P><LI-CODE lang="markup">[show_source] distributed = &lt;boolean&gt; * Whether or not a distributed search is performed to get events from all servers and indexes. * Turning this off results in better performance for show source, but events will only come from the initial server and index. * Default: true distributed_search_limit = &lt;unsigned integer&gt; * The maximum number of events that are requested when performing a search for distributed show source. * As this is used for a larger search than the initial non-distributed show source, it is larger than max_count * Splunk software rarely returns anywhere near this number of results, as excess results are pruned. * The point is to ensure the distributed search captures the target event in an environment with many events. * Default: 30000 max_count = &lt;integer&gt; * Maximum number of events accessible by show_source. * The show source command will fail when more than this many events are in the same second as the requested event. * Default: 10000 max_timeafter = &lt;timespan&gt; * Maximum time after requested event to show. * Default: '1day' (86400 seconds) max_timebefore = &lt;timespan&gt; * Maximum time before requested event to show. * Default: '1day' (86400 seconds)</LI-CODE><P>&nbsp;</P><P>Cheers,</P><P>Daniel</P> Fri, 09 Jun 2023 00:30:37 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-increase-the-number-of-results-in-quot-show-source-quot/m-p/646397#M16545 danspav 2023-06-09T00:30:37Z