Splunk Search

How can I limit the number of results that can be returned in a search (in UI)?

the_wolverine
Champion

I'd like to limit certain users from running expensive searches by limiting the number of results that can be returned by a search in UI. In version 3.x, we had a maxresults setting. How do I do this in version 4.0?

1 Solution

gkanapathy
Splunk Employee
Splunk Employee

For a specific search, you can use the head search command in your search. This does not limit users or search results globally.

There is no limitation on numbers of results in version 4.0. However, you can limit users by configuring a search window time limit for the user's role. This can be done in the Splunk Manager>Role, or using the srchTimeWin setting in authorize.conf.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

For a specific search, you can use the head search command in your search. This does not limit users or search results globally.

There is no limitation on numbers of results in version 4.0. However, you can limit users by configuring a search window time limit for the user's role. This can be done in the Splunk Manager>Role, or using the srchTimeWin setting in authorize.conf.

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...