Dashboards & Visualizations

Saved Searches Owners - too many users to display in drop down box

belka
Path Finder

I have a lot of users who have access to Splunk. When I look at the saved searches window, the drop down box to show "owner" populates with all my user base. Consequently, the drop down box does not show all the users, only about half way through the user list. Is there a way to make that drop down list longer so that it displays all users?

1 Solution

MuS
Legend

Hi belka and ahartge,

like everything in Splunk, this is set in a file. The file you're looking for is $SPLUNK_HOME/lib/python2.7/site-packages/splunk/appserver/mrsparkle/controllers/admin.py and on line 1666 you will see this:

# per SPL-24818 ... cap large user environments to 250... should we try to cache this or do something smarter here?
pwnrList = en.getEntities("authentication/users", count=250, search="roles=*")

There was a reason (SPL-24818) to cap this and obviously you can change it back here as well. But be aware that any future Splunk update could/will overwrite this file and change it back to the value count=250.

hope this helps ...

cheers, MuS

and remember if you break stuff, you have to fix it 😉

View solution in original post

tthrockm
Explorer

Glad to have found this fix, but patching Splunk's code (vs. maintaining config state) is not really maintainable for most users. A similar issue exists in data/ui/views/job_management.xml. Many enterprises have more than 250 users, and this seems like something that should be a configuration option.

I'd also point out that you can workaround the hardcoded limit w/out modifying the code by entering the desired userid in the search input (not as clean) or manually modify the url, replacing &pwnr=- with &pwnr=targetuserid

0 Karma

MuS
Legend

Hi belka and ahartge,

like everything in Splunk, this is set in a file. The file you're looking for is $SPLUNK_HOME/lib/python2.7/site-packages/splunk/appserver/mrsparkle/controllers/admin.py and on line 1666 you will see this:

# per SPL-24818 ... cap large user environments to 250... should we try to cache this or do something smarter here?
pwnrList = en.getEntities("authentication/users", count=250, search="roles=*")

There was a reason (SPL-24818) to cap this and obviously you can change it back here as well. But be aware that any future Splunk update could/will overwrite this file and change it back to the value count=250.

hope this helps ...

cheers, MuS

and remember if you break stuff, you have to fix it 😉

ahartge
Path Finder

I also see this issue on 5.0.4 & 6.1 (250 users only) I havent found a solution or answer yet.

0 Karma

chris
Motivator

Have you ever found an answer to this issue? I'm on 6.0.3 and only see 250 + any + nobody out of about 500 Users

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...