Dashboards & Visualizations

Chart HiddenSavedSearch not displaying all results

sonicZ
Contributor

Having an issue where our search on a dashboard with a certain view is not fully displaying all the results. I verified that many more results are returning when running the command line search string but something is wonky in our xml that is only displaying 11 results.
I've tried a few answer examples here to increase the results and height of the module but i still cant get over 11 results.

Our xml is as follows:

<view template="dashboard.html">
  <label>NOC Alert Dashboard</label>

  <module name="AccountBar" layoutPanel="appHeader">
    <param name="mode">lite</param>
  </module>

  <module name="TitleBar" layoutPanel="viewHeader">
    <param name="showActionsMenu">False</param>
  </module>

  <module name="HiddenSavedSearch" layoutPanel="panel_row1_col1" group="Six Hour Networking Critical Event Count" autoRun="True">
    <param name="savedSearch">Network Critical Event Counts</param>
    <param name="groupLabel">Six Hour Network Critical Event Count</param>
    <module name="JobProgressIndicator">
      <module name="HiddenChartFormatter">
        <param name="charting.chart.stackMode">stacked</param>
        <module name="FlashChart">
          <param name="width">100%</param>
          <param name="enableResize">False</param>
          <module name="ConvertToDrilldownSearch">
            <module name="ViewRedirector">
              <param name="viewTarget">flashtimeline</param>
            </module>
          </module>
        </module>
        <module name="ViewRedirectorLink">
          <param name="viewTarget">flashtimeline</param>
        </module>
      </module>
    </module>
  </module>

Search string is:
index=net | netcritical | search netcritical=true | timechart c by host | rename

Tags (3)
0 Karma
1 Solution

sonicZ
Contributor

Think i found the problem in other related answers, looks like i have to pass limit=0 to the timechart command like so

index=net earliest="-6h" | netcritical | search netcritical=true | timechart c by host limit=0 useother=f

View solution in original post

0 Karma

sonicZ
Contributor

Think i found the problem in other related answers, looks like i have to pass limit=0 to the timechart command like so

index=net earliest="-6h" | netcritical | search netcritical=true | timechart c by host limit=0 useother=f

0 Karma

MHibbin
Influencer

Are some of the results catergorised under "OTHER"? - have you tried including a "useother=f" in the timechart command.

Also, have you tried building a view with the actual search string (instead of the savedsearch).. I have some inexplicable issues with this sort of thing, and swapping out the savedsearch seems to help.

0 Karma

sonicZ
Contributor

I tried useother=f in the search and using the search string instead with no luck on limit going over 10

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...