Saved Searches Owners - too many users to display in drop down box

[belka]

I have a lot of users who have access to Splunk. When I look at the saved searches window, the drop down box to show "owner" populates with all my user base. Consequently, the drop down box does not show all the users, only about half way through the user list. Is there a way to make that drop down list longer so that it displays all users?

[tthrockm]

Glad to have found this fix, but patching Splunk's code (vs. maintaining config state) is not really maintainable for most users. A similar issue exists in data/ui/views/job_management.xml. Many enterprises have more than 250 users, and this seems like something that should be a configuration option.

I'd also point out that you can workaround the hardcoded limit w/out modifying the code by entering the desired userid in the search input (not as clean) or manually modify the url, replacing &pwnr=- with &pwnr=targetuserid

[MuS · Accepted solution]

Hi belka and ahartge,

like everything in Splunk, this is set in a file. The file you're looking for is $SPLUNK_HOME/lib/python2.7/site-packages/splunk/appserver/mrsparkle/controllers/admin.py and on line 1666 you will see this:

# per SPL-24818 ... cap large user environments to 250... should we try to cache this or do something smarter here?
pwnrList = en.getEntities("authentication/users", count=250, search="roles=*")

There was a reason (SPL-24818) to cap this and obviously you can change it back here as well. But be aware that any future Splunk update could/will overwrite this file and change it back to the value count=250.

hope this helps ...

cheers, MuS

and remember if you break stuff, you have to fix it 😉

[ahartge]

I also see this issue on 5.0.4 & 6.1 (250 users only) I havent found a solution or answer yet.

[chris]

Have you ever found an answer to this issue? I'm on 6.0.3 and only see 250 + any + nobody out of about 500 Users