This is both a question AND an answer. I want to see more than 50 lines of output on a results page? How do I do that? Being restricted to 10, 20 or 50 events worth of output stinks. Badly. Splunk doesn't provide a mechanism to do this, but it is changeable if you are adventurous. In $SPLUNK/share/splunk/search_mrsparkle/modules/results/page_controls/Count.html (back this file up first), add the following for 100 events under the "% endfor" at or near line 42: <option value="100">100</option> This will leave the 10, 20, and 50 with 50 being the default, but give you the option of 100. Reloading the search app will pick up the change, no need to restart Splunkweb. Enjoy. ... View more

Using Splunk 4.1.3, is there any combination of user role capabilities & indexes that will allow a user who doesn't have the admin role to be able to see the indexing_volume view? This is the view you see here: Splunk Search App -> Status -> Index Activity -> Indexing Volume. As a user with the stock user role, or the stock power role, a 404 page not found is received, with the Splunk specific error: Splunk cannot find the "indexing_volume" view. Thanks. ... View more