topic Re: How to show more than 50 events on a page in 6.x? in Splunk Search

How to show more than 50 events on a page in 6.x?

davidpaper — Wed, 16 Jul 2014 22:04:57 GMT

Hi,

In the image above, the selections are 10, 20 and 50 events per page. In 5.x, the flashtimeline.xml is editable to be able to add more choices. That seems to have disappeared in the new search view in 6.x.

Anyone figure out how to add additional options to this pulldown? My users REALLY like being able to stuff 100, 500, 1000, or 5000 events on the screen at once.

Thanks!

Re: How to show more than 50 events on a page in 6.x?

aferone — Thu, 06 Nov 2014 16:35:18 GMT

I am interested in this answer as well. The old posts don't seem to apply to 6.X, especially the flashtimeline stuff.

Re: How to show more than 50 events on a page in 6.x?

calbree — Sun, 18 Jan 2015 14:12:55 GMT

Anyone have any suggestions? This would be useful for us as well.

Re: How to show more than 50 events on a page in 6.x?

aferone — Tue, 20 Jan 2015 14:19:50 GMT

I opened a case with Splunk, and they told me it wasn't possible to make changes to increase the rows in 6.X, which I find baffling.

Re: How to show more than 50 events on a page in 6.x?

jkat54 — Mon, 04 Jan 2016 14:24:29 GMT

I gave it hackery hell and lost the battle ;-(

Re: How to show more than 50 events on a page in 6.x?

kbarker302 — Mon, 04 Jan 2016 15:39:30 GMT

FWIW, there appears to be a way to do this, but it may not be recommended. Look in the following file:

C:\Program Files\Splunk\share\splunk\search_mrsparkle\exposed\js\build\searchpage.js

and look for the first occurrence of "10 per page". There you will see where the options for the dropdown are defined.

I was able to modify the existing values, and also added an option for 150 per page. After restarting Splunk, I saw my changes take effect.

However, please note a couple of things - this is a minified JavaScript file, so it would be really easy to break if you have a typo. Also, this would mean modifying what appears to be a core Splunk JavaScript file, which is probably not supported. But just for academic reasons, there is a way to modify this dropdown list if you really want to.

Re: How to show more than 50 events on a page in 6.x?

davidpaper — Tue, 16 Feb 2016 17:44:10 GMT

Thank you! I've been looking for a way to do this. Very sad that it's no longer officially supported via the flashtimeline.xml.

I found it (v6.3.1) by looking for this string: "this.model.report.entry.content,items" and replicating the ",{value:"10",label:_("10 Per Page").t()}" section with the new values I wanted to add at the end after the 50.

This is definitely going to get overwritten at upgrade time, and is not going to be officially supported by Splunk.

Thanks for posting this.

Re: How to show more than 50 events on a page in 6.x?

michealrp — Mon, 10 Oct 2016 20:56:05 GMT

So, since version 3.x, at least as I recall, this has been asked time and time again. Yet, it's not a built in feature of the application. I'm curious why this isn't yet built in. 50 lines is quite a bit if you're on a mom and pop shop, however, in my environment, I'm using this for syslog entries as well as SIP traffic logging. Often, 50 lines isn't enough without cycling through the additional pages.

Re: How to show more than 50 events on a page in 6.x?

myudkowsky — Mon, 31 Oct 2016 19:21:18 GMT

Unfortunately, this fix no longer seems to work. My current savesearches.js now looks like this:

this.children.count = new s({
                    modelAttribute: "display.prefs.events.count",
                    model: this.model.content,
                    items: [{
                        value: "10",
                        label: _("10 Per Page").t()
                    }, {
                        value: "20",
                        label: _("20 Per Page").t()
                    }, {
                        value: "50",
                        label: _("50 Per Page").t()
                    }, {
                        value: "100",
                        label: _("100 Per Page").t()
                    }, {
                        value: "250",
                        label: _("250 Per Page").t()
                    }],
                    save: !4,
                    elastic: !0,
                    menuWidth: "narrow",
                    toggleClassName: "btn-pill",
                    popdownOptions: {
                        attachDialogTo: "body"
                    }
                })

However, the "250 Per Page" does not appear on the drop-down menu, and of course the default is not 250.'

Any ideas? I'll keep on searching, but so far no luck.

I'd also like to see the default of "All Time" in the search bar by something more reasonable, such as 24 hours. Any ideas on how to find and modify it?

Re: How to show more than 50 events on a page in 6.x?

myudkowsky — Mon, 31 Oct 2016 19:22:04 GMT

P.S. I have un-minified the JS using a tool in order to avoid any errors in my edits.

Re: How to show more than 50 events on a page in 6.x?

davidpaper — Tue, 01 Nov 2016 00:05:48 GMT

Check into modifying times.conf to change the default.

No idea on why the hack above no longer works. What version are you running that it stopped working?

Re: How to show more than 50 events on a page in 6.x?

myudkowsky — Tue, 01 Nov 2016 00:53:12 GMT

I apologize - I failed to check in advance. I'm using

VERSION=6.2.1
BUILD=245427
PRODUCT=splunk
PLATFORM=Linux-x86_64

Is it possible the same exact text does not work in 6.2.x, but does in 6.3.x? This file is "clearly" the file, as its original settings of count=20 as the default ("save: !1") are still in place. I wonder if I have to quit the browser and/or flush the cache...

I will look into times.conf; so far I can't see how to set the default.

Re: How to show more than 50 events on a page in 6.x?

myudkowsky — Tue, 01 Nov 2016 01:03:13 GMT

And there you have it: had to flush the browser cache. "50" comes up as default instead of "250" lines per page, but at least it's feasible. Questions are now:

What is the correct way to create a new default for number of lines per page?
Where is the setting for default time range for searches? "All Time" is not helpful, and in fact quite an odd choice.

Re: How to show more than 50 events on a page in 6.x?

davidpaper — Tue, 29 Sep 2020 11:34:57 GMT

1) Not sure. I never figured out how to change the default.

2) Oops, I was wrong. it's ui-prefs.conf.

Create a file: $SPLUNK_HOME/etc/apps/search/local/ui-prefs.conf
Create a search stanza like this:

[search]
dispatch.earliest_time = -7d@d
dispatch.latest_time = now

Restart Splunk and you're good to go!

Re: How to show more than 50 events on a page in 6.x?

myudkowsky — Tue, 01 Nov 2016 11:47:31 GMT

Excellent, thank you.

FYI I had to create a copy of this in a separate app - that is, in
etc/apps/prophecy-premise/local/
because my setup has that app, with specialized searches, built-in by the provider. And "of course" I flushed the browser cache.

I'll continue to pursue setting the default for the number of rows per page. I'm guessing that it's possible to set it.

Re: How to show more than 50 events on a page in 6.x?

myudkowsky — Tue, 01 Nov 2016 12:00:46 GMT

Update: adding

display.prefs.events.count = 250

to the ui-prefs.conf stanza did not work.

Re: How to show more than 50 events on a page in 6.x?

myudkowsky — Mon, 04 Sep 2017 18:58:53 GMT

As of September 2017, working on a new installation, I have still not found a way to modify the current searches to use 250 lines by default.