Configuring resource restrictions

Set resource restrictions to apply time or data limitations to event and flow searches.

About this task

You can set the following types of resource restrictions:
  • Execution time restrictions specify the maximum amount of time that a query runs before data is returned.
  • Time span restrictions specify the time span of the data to be searched.
  • Record limit restrictions specify the number of data records that are returned by a search query.

Users who run searches that are limited by resource restrictions see the resource restriction icon (resource restriction icon) next to the search criteria.

Note: The search result set is often larger than the specified record limit. When the record limit is reached, the search manager signals all search participants to stop (there are multiple search participants even on a single system), but results continue to accumulate until the search fully stops on all participants. All search results are added to the result set.

Procedure

  1. On the navigation menu ( Navigation menu icon ), click Admin.
  2. In the System Configuration section, click Resource Restrictions.
  3. If your deployment has tenants that are configured, click Role or Tenant to specify the type of restrictions to set.
  4. Double-click the role or tenant that you want to set restrictions for.
  5. To set restrictions for all users who are assigned to the user role or tenant, follow these steps:
    1. Click the summary row at the top to open the Edit Restriction dialog box.
    2. Click Enabled for the type of restriction that you want to set, and specify the restriction values.
    3. Click Save.
  6. To set restrictions for a specific user, follow these steps:
    1. Double-click the user that you want to set the restrictions for.
      To search for a user, type the user name in the filter field.
    2. Click Enabled for the type of restriction that you want to set, and specify the restriction values.
    3. Click Save.