Archive
Highlighted

embedded tables limited to 20 rows ?

Explorer

I use some embedded reports and they work fine. Now i made an upgrade to Version 6.3 and a Searchhead-Cluster. Now embedded tables (that worked before) show only 20 rows. Any ideas how to fix this or is this a known bug ?

Highlighted

Re: embedded tables limited to 20 rows ?

SplunkTrust
SplunkTrust

If you look at this example, there is a rowNumbers json element in the html. Search for rowNumbers.

http://dev.splunk.com/view/SP-CAAAE5Q

0 Karma
Highlighted

Re: embedded tables limited to 20 rows ?

Explorer

Thanks, but this example shows a dashboard. That will work as a workaround, but the embedded reports worked before we've build a seachrheadcluster with Version 6.3.

0 Karma
Highlighted

Re: embedded tables limited to 20 rows ?

SplunkTrust
SplunkTrust

Have you tried rebuilding the embedded reports after the cluster was built?

Maybe some local settings are configured, etc.

0 Karma
Highlighted

Re: embedded tables limited to 20 rows ?

Explorer

Yes, i rebuilded the report. And i made some new testreports to embed them. They all show just 20 rows.

0 Karma
Highlighted

Re: embedded tables limited to 20 rows ?

New Member

I still hit this issue in splunk 6.6.1. Is this bug fixed in any new version or any plan to fix this?

0 Karma
Highlighted

Re: embedded tables limited to 20 rows ?

Champion

https://docs.splunk.com/Documentation/Splunk/7.0.3/Report/Embedscheduledreports

"Embedded reports do not have all the features of reports as viewed in Splunk Web. For example, embedded reports do not have drilldown functionality, support for workflow actions, table sorting, or field expansion. When embedded reports display table visualizations, those tables are limited to 10 rows. "

0 Karma
Highlighted

Re: embedded tables limited to 20 rows ?

Explorer

Meanwhile we received a reply from the support-team:

"We currently have a bug open for this issue. (SPL-109078)
The developers are pushing the fix into the next major release, since fixing this would be a visible change. I don't yet know what version it will be included in.
At this time, there is no workaround for this."

View solution in original post

Highlighted

Re: embedded tables limited to 20 rows ?

Champion

In version 6.6* and 7, it looks like the limit to table rows has been reduced to 10.

"Embedded reports do not have all the features of reports as viewed in Splunk Web. For example, embedded reports do not have drilldown functionality, support for workflow actions, table sorting, or field expansion. When embedded reports display table visualizations, those tables are limited to 10 rows. "

0 Karma
Highlighted

Re: embedded tables limited to 20 rows ?

Path Finder

You can use streamstats to chop your results into multiple embedded searches, if that works.
Then embed the multiple URLs where you want them. Not a perfect solution.

For instance, if you always had fewer than 60 results, you could use the following snippets.

|  streamstats count as row_num
|  where row_num < 21
| fields – row_num

|  where row_num >20 AND row_num < 41

|  where row_num >40
0 Karma