Dashboards & Visualizations

Can you help solve a problem I'm having with a custom visualization that returns over 50k search results?

SK8
Explorer

Hello,

I have a problem with a custom visualization. This gets a large amount of results (over 50k). I retrieve them with this example from the following blog Post (https://www.splunk.com/blog/2016/04/11/show-me-your-viz.html), just like in section 3b.

For the initial call it works fine, too.

However, there is a problem with an installation in a dashboard with filters. If the first result is above the chunk size, the offset is increased with UpdateDataParams. If I then limit the search further with the filters so that the quantity is below the previous chunk size, then I get the display "No results found." But there are still results. The Custom Visualization doesn't come into the UpdateView method anymore, because — probably — the current offset is higher than the current result set.

So how can I set the offset back to 0?

SK8
Explorer

We've identified the problem. We are currently working in this project with Splunk version 6.6.2. In this version this error occurs when chunking. In previous (6.5.2) and subsequent versions (7.1.0) it is no problem with our implementation. So there will be an internal splunk problem in this version.

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...