The right asnwear is : http://splunk-base.splunk.com/answers/26392/show-most-relevant-lines-exceeds-500-limit You have to modify the xml file to set a higher limit. Using maxevents=1000 do nothing, as the maxevents is already at 1000 by default. The limitation is on the display, not on the search. ... View more