Dashboards & Visualizations

How should I dynamically change the limit parameter in the head command

vaguiar
Engager

I have a search command which pipes to "| head limit=10". But I want to let the user decide if they see 10 or 20 or all the events returned.

One way that I could think of was by adding a drop-down with specific values such as 10, 20 and 999,999,999(very large number) and by passing that value as the limit of the head command. I wonder if there's a better way to do this though.

0 Karma
1 Solution

woodcock
Esteemed Legend

do a drop down and pass the entire command, not just the value, like this:

<input type="dropdown" token="count_filter">
  <label>Limit your Results</label>
  <choice value="">ALL (no filter)</choice>
  <choice value="| head 10">10</choice>
  <choice value="| head 20">20</choice>
  <default>All (no filter)</default>
</input>

Then the last line of your search should be $count_filter$ (without a leading pipe). This way you do not need that "huge number" aspect.

View solution in original post

woodcock
Esteemed Legend

do a drop down and pass the entire command, not just the value, like this:

<input type="dropdown" token="count_filter">
  <label>Limit your Results</label>
  <choice value="">ALL (no filter)</choice>
  <choice value="| head 10">10</choice>
  <choice value="| head 20">20</choice>
  <default>All (no filter)</default>
</input>

Then the last line of your search should be $count_filter$ (without a leading pipe). This way you do not need that "huge number" aspect.

vaguiar
Engager

Good point and it let's me select a default value as well. Thanks!

0 Karma

cmerriman
Super Champion

You could just use a text box with the header of "result count (enter whole number)" and use that token if you want them to get the number of results they desire.

Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...