These options are loaded from $SPLUNK_HOME/etc/apps/search/default/data/ui/views/show_source.xml
. You could tune this by placing an edited version of this file in $SPLUNK_HOME/etc/apps/search/local/data/ui/views/show_source.xml
. However, there's an implicit limit on the number of events that can be retrieved based on a time bound around the target event, which in 4.1.x is 1 day.
Does anyone know what needs added/changed in the show_source.xml file to raise this limit? My file doesn't have anything specifying any values at all.
you can edit the view directly in the UI and add your limits.
search app
ui > view > showsource > edit xml
These options are loaded from $SPLUNK_HOME/etc/apps/search/default/data/ui/views/show_source.xml
. You could tune this by placing an edited version of this file in $SPLUNK_HOME/etc/apps/search/local/data/ui/views/show_source.xml
. However, there's an implicit limit on the number of events that can be retrieved based on a time bound around the target event, which in 4.1.x is 1 day.