Having an issue where our search on a dashboard with a certain view is not fully displaying all the results. I verified that many more results are returning when running the command line search string but something is wonky in our xml that is only displaying 11 results.
I've tried a few answer examples here to increase the results and height of the module but i still cant get over 11 results.
Our xml is as follows:
<view template="dashboard.html">
<label>NOC Alert Dashboard</label>
<module name="AccountBar" layoutPanel="appHeader">
<param name="mode">lite</param>
</module>
<module name="TitleBar" layoutPanel="viewHeader">
<param name="showActionsMenu">False</param>
</module>
<module name="HiddenSavedSearch" layoutPanel="panel_row1_col1" group="Six Hour Networking Critical Event Count" autoRun="True">
<param name="savedSearch">Network Critical Event Counts</param>
<param name="groupLabel">Six Hour Network Critical Event Count</param>
<module name="JobProgressIndicator">
<module name="HiddenChartFormatter">
<param name="charting.chart.stackMode">stacked</param>
<module name="FlashChart">
<param name="width">100%</param>
<param name="enableResize">False</param>
<module name="ConvertToDrilldownSearch">
<module name="ViewRedirector">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>
<module name="ViewRedirectorLink">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>
</module>
Search string is:
index=net | netcritical | search netcritical=true | timechart c by host | rename
Think i found the problem in other related answers, looks like i have to pass limit=0 to the timechart command like so
index=net earliest="-6h" | netcritical | search netcritical=true | timechart c by host limit=0 useother=f
Think i found the problem in other related answers, looks like i have to pass limit=0 to the timechart command like so
index=net earliest="-6h" | netcritical | search netcritical=true | timechart c by host limit=0 useother=f
Are some of the results catergorised under "OTHER"? - have you tried including a "useother=f" in the timechart command.
Also, have you tried building a view with the actual search string (instead of the savedsearch).. I have some inexplicable issues with this sort of thing, and swapping out the savedsearch seems to help.
I tried useother=f in the search and using the search string instead with no luck on limit going over 10