Splunk Search Limits

[masonwillinger]

All searches appear to be limited to 1000 results in the UI. Can this be modified in a configuration setting somewhere?

Screenshot of message indicating that the limit is 1000 has been attached.

[manish_singh_77]

The default value of 50000 can be modified by editing the [searchresults] stanza in limits.conf:

 [searchresults]
 maxresultrows = 100000

[masonwillinger]

Thanks Manish. If the default value is 50000, then why are we seeing a limit of 1000? I don't think we've ever changed this value, mostly because we're in a managed cloud instance and don't have access to change that value. Perhaps the default is different for cloud instances?

[manish_singh_77]

Check this link: https://docs.splunk.com/Documentation/SplunkCloud/8.0.2004/User/ConcurrentLimits#:~:text=In%20Splunk...