One thing which could help you with bad searches is Splunk Workload Management https://www.splunk.com/en_us/blog/tips-and-tricks/best-practices-for-using-splunk-workload-management.html You could define different classes for users and admins etc.  r. Ismo ... View more