topic Re: Show most relevant lines (Exceeds 500 limit) in Splunk Search

Show most relevant lines (Exceeds 500 limit)

hjwang — Thu, 16 Jun 2011 09:19:10 GMT

Hi~there,

We index some system config file to facilitate user's lookup.
But it seems the splunk have the limits in showing only 500 lines per event.
I try to add MAX_EVENT = 10000 in props.conf of search apps, but it still does not work. Any workaround for this? Thanks for your help.

Re: Show most relevant lines (Exceeds 500 limit)

hazekamp — Thu, 16 Jun 2011 17:49:13 GMT

hjwang,

You need to modify the XML configuration for views that have the EventsViewer module (namely flashtimeline) to override the 500 limit in the UI. This is achieved by setting the maxLines param to 0 and maxLinesContraint to X. I wouldn't recommend going to high with maxLinesConstraint since it is listed as a "Browser crash control setting". Your modifications should reflect:

## Snippet from $SPLUNK_HOME/etc/apps/search/local/data/ui/views/flashtimeline.xml
<module name="EventsViewer" layoutPanel="resultsAreaLeft">
  <param name="segmentation">full</param>
  <param name="reportFieldLink">report_builder_format_report</param>
  <!-- Override display # of lines to 1000 -->
  <param name="maxLines">0</param>
  <param name="maxLinesConstraint">1000</param>

Re: Show most relevant lines (Exceeds 500 limit)

hjwang — Fri, 17 Jun 2011 01:56:42 GMT

hazekamp, thank you very much. it really works

Re: Show most relevant lines (Exceeds 500 limit)

fastauto — Fri, 18 Jan 2013 17:14:41 GMT

Awesome tip. I would be great if the limit was part of the limits.conf configuration. As is, it has to be changed for every new release.

Re: Show most relevant lines (Exceeds 500 limit)

dmaislin_splunk — Fri, 15 Mar 2013 12:18:22 GMT

Nothing stops you from copying flashtimeline.xml to a different view/app and making your changes there. Then they would not get overridden.

Re: Show most relevant lines (Exceeds 500 limit)

the_wolverine — Thu, 05 Dec 2013 16:45:46 GMT

Which version(s) does this apply to? It doesn't appear to work in version 5.0.3 -- I'm still being limited by UI displaying only most relevant 500 lines despite this modification.

Re: Show most relevant lines (Exceeds 500 limit)

withool000 — Mon, 06 Oct 2014 09:14:48 GMT

I am using version 5.0.3.
The maximum number that I can specify is 500. An error message will show, if I put the greater number than that.

Any recommendation on this please.

Re: Show most relevant lines (Exceeds 500 limit)

landen99 — Thu, 19 Nov 2015 14:19:01 GMT

https://answers.splunk.com/answers/243049/show-all-lines-for-windows-event-log-events.html#answer-329087

Directly above the data and below the timeline (on the Event tab and beneath tab with the word "Visualization") there is a "Format" Option where you can set "Max Lines" to "All lines"

Re: Show most relevant lines (Exceeds 500 limit)

jimdiconectiv — Tue, 28 Mar 2017 20:34:12 GMT

This looks very promising, but I can't find the relevent section of flashtimeline.xml in the "default" dir. My guess is they have changed how this is done. This is versin 6.5 .

Re: Show most relevant lines (Exceeds 500 limit)

hazekamp — Tue, 28 Mar 2017 22:20:55 GMT

Yes, flashtimeline.xml (the original advanced xml implementation of the search page) is no longer valid. I'm not 100% certain what this looks like in modern versions, but I can dig a bit.