Dashboards & Visualizations

Saved Searches Owners - too many users to display in drop down box

belka
Path Finder

I have a lot of users who have access to Splunk. When I look at the saved searches window, the drop down box to show "owner" populates with all my user base. Consequently, the drop down box does not show all the users, only about half way through the user list. Is there a way to make that drop down list longer so that it displays all users?

1 Solution

MuS
Legend

Hi belka and ahartge,

like everything in Splunk, this is set in a file. The file you're looking for is $SPLUNK_HOME/lib/python2.7/site-packages/splunk/appserver/mrsparkle/controllers/admin.py and on line 1666 you will see this:

# per SPL-24818 ... cap large user environments to 250... should we try to cache this or do something smarter here?
pwnrList = en.getEntities("authentication/users", count=250, search="roles=*")

There was a reason (SPL-24818) to cap this and obviously you can change it back here as well. But be aware that any future Splunk update could/will overwrite this file and change it back to the value count=250.

hope this helps ...

cheers, MuS

and remember if you break stuff, you have to fix it 😉

View solution in original post

tthrockm
Explorer

Glad to have found this fix, but patching Splunk's code (vs. maintaining config state) is not really maintainable for most users. A similar issue exists in data/ui/views/job_management.xml. Many enterprises have more than 250 users, and this seems like something that should be a configuration option.

I'd also point out that you can workaround the hardcoded limit w/out modifying the code by entering the desired userid in the search input (not as clean) or manually modify the url, replacing &pwnr=- with &pwnr=targetuserid

0 Karma

MuS
Legend

Hi belka and ahartge,

like everything in Splunk, this is set in a file. The file you're looking for is $SPLUNK_HOME/lib/python2.7/site-packages/splunk/appserver/mrsparkle/controllers/admin.py and on line 1666 you will see this:

# per SPL-24818 ... cap large user environments to 250... should we try to cache this or do something smarter here?
pwnrList = en.getEntities("authentication/users", count=250, search="roles=*")

There was a reason (SPL-24818) to cap this and obviously you can change it back here as well. But be aware that any future Splunk update could/will overwrite this file and change it back to the value count=250.

hope this helps ...

cheers, MuS

and remember if you break stuff, you have to fix it 😉

ahartge
Path Finder

I also see this issue on 5.0.4 & 6.1 (250 users only) I havent found a solution or answer yet.

0 Karma

chris
Motivator

Have you ever found an answer to this issue? I'm on 6.0.3 and only see 250 + any + nobody out of about 500 Users

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...