topic Re: How to increase the list of results in my dashboard to display more than 1020 results? in Dashboards & Visualizations

How to increase the list of results in my dashboard to display more than 1020 results?

svemurilv — Mon, 30 Jan 2017 15:34:29 GMT

Hi Team,
I have a Dashboard displaying the log events List of the specific date. When I am trying to displays all _raw events list, my dashboard shows only 1020 events count, is there any way to display complete raw log events in dashboard, without updating my Limits.conf file or some other .conf changes

using the search index=main source="/home/apps/loader/logs/$date_log$/$processname$" $loglevel$ "$search$"
-Thanks.

Re: How to increase the list of results in my dashboard to display more than 1020 results?

rjthibod — Mon, 30 Jan 2017 17:20:44 GMT

You probably need to put | table _time _raw on the end of your query.

https://answers.splunk.com/answers/169448/splunk-search-limits-results-to-1000-events-only.html

Re: How to increase the list of results in my dashboard to display more than 1020 results?

svemurilv — Mon, 30 Jan 2017 17:44:24 GMT

Hi rjthibod
this doesn't help full to pull all my 6K events, again its showing 1020 events only instead of all events.

Re: How to increase the list of results in my dashboard to display more than 1020 results?

rjthibod — Mon, 30 Jan 2017 17:51:15 GMT

If I add an event table with raw results, I can retrieve thousands of events.

Please share your XML that you are using. Also, what version of Splunk?

Re: How to increase the list of results in my dashboard to display more than 1020 results?

svemurilv — Mon, 30 Jan 2017 17:58:43 GMT

<panel>
  <event>
    <search>
      <query>   index=main source="/home/gdloader/gdloader/logs/$date_log$/$processname$" $loglevel$ "$search$"  | table _time _raw </query>
      <earliest>$time_sel.earliest$</earliest>
      <latest>$time_sel.latest$</latest>
       </search>
     </event>
</panel>

Re: How to increase the list of results in my dashboard to display more than 1020 results?

rjthibod — Mon, 30 Jan 2017 18:09:09 GMT

What happens if you add these options? How many pages of results do you see?

 <panel>
   <event>
     <search>
       <query>   index=main source="/home/gdloader/gdloader/logs/$date_log$/$processname$" $loglevel$ "$search$"  | table _time _raw </query>
       <earliest>$time_sel.earliest$</earliest>
       <latest>$time_sel.latest$</latest>
        </search>
        <option name="count">100</option>
        <option name="type">raw</option>
      </event>
 </panel>

Re: How to increase the list of results in my dashboard to display more than 1020 results?

svemurilv — Mon, 30 Jan 2017 18:13:46 GMT

Same out pot no change its displaying only 1020 raw events , that's it

Re: How to increase the list of results in my dashboard to display more than 1020 results?

rjthibod — Mon, 30 Jan 2017 18:18:41 GMT

What version of Splunk are you using?

Re: How to increase the list of results in my dashboard to display more than 1020 results?

svemurilv — Mon, 30 Jan 2017 18:22:52 GMT

its bit old version 6.2

Re: How to increase the list of results in my dashboard to display more than 1020 results?

rjthibod — Mon, 30 Jan 2017 18:24:10 GMT

hmm, that maybe the issue. hold on.

Re: How to increase the list of results in my dashboard to display more than 1020 results?

rjthibod — Mon, 30 Jan 2017 18:28:38 GMT

Yes, mine gets truncated at 2000 lines on 6.2, and the total proparly depends on how big the raw events are.

You probably can't change this since it is likely limited in the JS stack, not inherent to the search head limits.

In general, there should be no reason for displaying that many raw events, because it will be impossible to find anything. I think you need to reconsider what you are doing with the data.

Re: How to increase the list of results in my dashboard to display more than 1020 results?

svemurilv — Mon, 30 Jan 2017 20:05:46 GMT

Hi,
Am seeing same issues with staging which is running on latest 6.5.1 version.

-thanks

Re: How to increase the list of results in my dashboard to display more than 1020 results?

frobinson_splun — Mon, 30 Jan 2017 20:21:29 GMT

Hi @svemurilv,
Here is some documentation on configuring data truncation using the web.conf file and/or Simple XML:

http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/ChartDisplayissues#Data_truncation
http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/ChartDisplayissues#Configuration_file_data_truncation_settings

Hope this helps!

Re: How to increase the list of results in my dashboard to display more than 1020 results?

rjthibod — Mon, 30 Jan 2017 20:25:38 GMT

Hmm, strange. I don't see in 6.5 like I do in 6.2.

Re: How to increase the list of results in my dashboard to display more than 1020 results?

svemurilv — Mon, 30 Jan 2017 21:30:30 GMT

This code is working

   <table>
    <search>
      <query>index=* source="/home/XXXXXXX/XXXXXX/logs/$date_log$/$processname$" $loglevel$ "$search$" | table _time _raw |sort +_time</query>
      <earliest>$time_sel.earliest$</earliest>
      <latest>$time_sel.latest$</latest>
      <sampleRatio>1</sampleRatio>
    </search>
    <option name="count">100</option>
    <option name="dataOverlayMode">none</option>
    <option name="drilldown">cell</option>
    <option name="percentagesRow">false</option>
    <option name="rowNumbers">false</option>
    <option name="totalsRow">false</option>
    <option name="wrap">true</option>
  </table>

Re: How to increase the list of results in my dashboard to display more than 1020 results?

rjthibod — Mon, 30 Jan 2017 21:36:44 GMT

in 6.5 correct?

Re: How to increase the list of results in my dashboard to display more than 1020 results?

svemurilv — Mon, 30 Jan 2017 22:05:47 GMT

yeah for both 6.2 and 6.5.1