Is there a setting to increase the "results per page" value when you show source?

[Jeremiah]

When I go to show source on an event, the maximum number of results I can display is 1000 (the "Results per page" dropdown). Is there a setting to increase this value?

[teh21]

Does anyone know what needs added/changed in the show_source.xml file to raise this limit? My file doesn't have anything specifying any values at all.

[yannK]

you can edit the view directly in the UI and add your limits.

search app
ui > view > showsource > edit xml

[Stephen_Sorkin · Accepted solution]

These options are loaded from $SPLUNK_HOME/etc/apps/search/default/data/ui/views/show_source.xml. You could tune this by placing an edited version of this file in $SPLUNK_HOME/etc/apps/search/local/data/ui/views/show_source.xml. However, there's an implicit limit on the number of events that can be retrieved based on a time bound around the target event, which in 4.1.x is 1 day.