Dashboards & Visualizations

Saved Searches Owners - too many users to display in drop down box

Path Finder

I have a lot of users who have access to Splunk. When I look at the saved searches window, the drop down box to show "owner" populates with all my user base. Consequently, the drop down box does not show all the users, only about half way through the user list. Is there a way to make that drop down list longer so that it displays all users?

1 Solution

SplunkTrust
SplunkTrust

Hi belka and ahartge,

like everything in Splunk, this is set in a file. The file you're looking for is $SPLUNK_HOME/lib/python2.7/site-packages/splunk/appserver/mrsparkle/controllers/admin.py and on line 1666 you will see this:

# per SPL-24818 ... cap large user environments to 250... should we try to cache this or do something smarter here?
pwnrList = en.getEntities("authentication/users", count=250, search="roles=*")

There was a reason (SPL-24818) to cap this and obviously you can change it back here as well. But be aware that any future Splunk update could/will overwrite this file and change it back to the value count=250.

hope this helps ...

cheers, MuS

and remember if you break stuff, you have to fix it 😉

View solution in original post

Explorer

Glad to have found this fix, but patching Splunk's code (vs. maintaining config state) is not really maintainable for most users. A similar issue exists in data/ui/views/job_management.xml. Many enterprises have more than 250 users, and this seems like something that should be a configuration option.

I'd also point out that you can workaround the hardcoded limit w/out modifying the code by entering the desired userid in the search input (not as clean) or manually modify the url, replacing &pwnr=- with &pwnr=targetuserid

0 Karma

SplunkTrust
SplunkTrust

Hi belka and ahartge,

like everything in Splunk, this is set in a file. The file you're looking for is $SPLUNK_HOME/lib/python2.7/site-packages/splunk/appserver/mrsparkle/controllers/admin.py and on line 1666 you will see this:

# per SPL-24818 ... cap large user environments to 250... should we try to cache this or do something smarter here?
pwnrList = en.getEntities("authentication/users", count=250, search="roles=*")

There was a reason (SPL-24818) to cap this and obviously you can change it back here as well. But be aware that any future Splunk update could/will overwrite this file and change it back to the value count=250.

hope this helps ...

cheers, MuS

and remember if you break stuff, you have to fix it 😉

View solution in original post

Path Finder

I also see this issue on 5.0.4 & 6.1 (250 users only) I havent found a solution or answer yet.

0 Karma

Motivator

Have you ever found an answer to this issue? I'm on 6.0.3 and only see 250 + any + nobody out of about 500 Users

0 Karma