topic Dashboard Tables: Limiting the number of displayed rows in Dashboards & Visualizations

Dashboard Tables: Limiting the number of displayed rows

egerner — Thu, 30 Jun 2011 21:07:56 GMT

I am having an issue with some of the table options. I’d like to limit the table to 10 rows and then allow pagination. Here are my commands (simple xml):

 <option name="count">10</option>
 <option name="showPager">true</option>

While the pagination seems to be working, the count option doesn’t work at all – it defaults to displaying however many rows I had displayed in my saved search (ie, 50) and only does pagination after this point. Are my commands wrong, or is something else the problem? Any ideas?

Re: Dashboard Tables: Limiting the number of displayed rows

mw — Thu, 30 Jun 2011 23:54:24 GMT

What is your search that renders the table? I've never experienced this, but my searches tend to be something like "... | table field1, field2". Are you using the table command or something else?

Re: Dashboard Tables: Limiting the number of displayed rows

hulahoop — Fri, 01 Jul 2011 20:09:16 GMT

Emily, you're right. The count option has no effect. The showPager option does. See if this workaround works for you:

in the flash timeline view, set 'Results per page' to 10
save your search as a new search (this associates a new viewstate with the paginator count as 10)
use the new saved search in your dashboard.

Alternatively, you (or your Splunk Admin) can correct the viewstate:

find the viewstate id associated with the saved search in savedsearches.conf (e.g. vsid=gp902hc2)
find the viewstate using the vsid in viewstates.conf.
edit the Count_#_#_#.default, MaxLines_#_#_#.default, MaxLines_#_#_#.maxLines variables.
restart Splunk.

This is a bug, which I will file on your behalf. Thank you for bringing this to our attention. 🙂

Re: Dashboard Tables: Limiting the number of displayed rows

jbsplunk — Fri, 22 Jul 2011 18:02:29 GMT

This is being tracked as SPL-32968. The problem is regarding applying viewstate. When a search is saved, a copy of the current view state is made and stored in $SPLUNK_HOME/etc/users/admin/search/local/viewstates.conf. When the search is loaded, the configuration that is last applied is the viewstate and this is clobbering the XML defined "count" option.

This is going to be fixed in 4.2.3, for anyone who is interested.