How to set up a limit to max no of events to be searched

[tmuthuk]

Is there anyway to restrict the max no of events to be searched in an index irrespective of the time chosen the time picker ?

Example : i have 100000 events in a index. But i want the queries executed by users to search only latest 50000 records , irrespective the of the time chosen by the user

[somesoni2]

There is not way to limit the no of events returned by a search, by applying implicit restriction.

For specific searches, you can use "| head X" to limit the no of rows to latest 'X' results, but this is just that particular search level, not the user level or global.

Other restriction that you can apply to limit the no of rows accessed by users is by limiting the time window that they can use. This can be done at Role level (from Splunk UI-> Access Controls -> Roles -> Restrict search time range (value in second), from authorize.conf file in $SPLUNK_HOME/etc/system/local (create if not exists -> Under specific Role -> srchTimeWin stanza)

[tmuthuk]

Thanks for your reply.

[gkanapathy]

No, but there is a way to limit the max time range a user can select in the role configuration parameters, which should have a similar effect.

[gkanapathy]

The setting on on the role definition manager screen.

[tmuthuk]

Thanks for your Reply .

Could you please explain me how could we set the maximum time range ?