can't sort table results from a form search

dmlee — Thu, 03 Nov 2011 09:24:51 GMT

I wrote a simple form search dashboard using <table> module .

I found if the number of results over 50,000 , when I click any label of table fields (for example : please refer to below source code , if I click the label said s_Seq , table module will sort whole result base on the content of s_Seq field) , the table won't sort results correctly , if the number of results is less then 50,000 , sort function works fine .

anyone know why ? thanks.

<?xml version="1.0" encoding="UTF-8"?>
<form>
    <fieldset>
        <input type="time" />
    </fieldset>
        <row>
            <table>
                <searchTemplate> sourcetype=abc Type=2 | where len(ProdId)&lt;10| dedup SeqNo | sort 0 SeqNo | delta SeqNo as diff | where diff&gt;1  | eval s_Seq=SeqNo-diff+1 | eval e_Seq=if(diff&gt;2,SeqNo-1,"")  | eval s_time=strftime(_time,"%Y/%m/%d %H:%M:%S.%3N") | eval lost=diff-1 </searchTemplate>
                <option name="count">10</option>
                <option name="showPager">true</option>
                <fields>s_time, s_Seq, e_Seq, lost</fields>
            </table>
        </row>
</form>

Re: can't sort table results from a form search

dmlee — Mon, 07 Nov 2011 09:41:51 GMT

this issue can be solved by using Sideview's module "Pager" , thanks Nick.

topic Re: can't sort table results from a form search in Splunk Search

can't sort table results from a form search

Re: can't sort table results from a form search