Dashboards & Visualizations

How should I dynamically change the limit parameter in the head command

vaguiar
Engager

I have a search command which pipes to "| head limit=10". But I want to let the user decide if they see 10 or 20 or all the events returned.

One way that I could think of was by adding a drop-down with specific values such as 10, 20 and 999,999,999(very large number) and by passing that value as the limit of the head command. I wonder if there's a better way to do this though.

0 Karma
1 Solution

woodcock
Esteemed Legend

do a drop down and pass the entire command, not just the value, like this:

<input type="dropdown" token="count_filter">
  <label>Limit your Results</label>
  <choice value="">ALL (no filter)</choice>
  <choice value="| head 10">10</choice>
  <choice value="| head 20">20</choice>
  <default>All (no filter)</default>
</input>

Then the last line of your search should be $count_filter$ (without a leading pipe). This way you do not need that "huge number" aspect.

View solution in original post

woodcock
Esteemed Legend

do a drop down and pass the entire command, not just the value, like this:

<input type="dropdown" token="count_filter">
  <label>Limit your Results</label>
  <choice value="">ALL (no filter)</choice>
  <choice value="| head 10">10</choice>
  <choice value="| head 20">20</choice>
  <default>All (no filter)</default>
</input>

Then the last line of your search should be $count_filter$ (without a leading pipe). This way you do not need that "huge number" aspect.

vaguiar
Engager

Good point and it let's me select a default value as well. Thanks!

0 Karma

cmerriman
Super Champion

You could just use a text box with the header of "result count (enter whole number)" and use that token if you want them to get the number of results they desire.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...