Dashboards & Visualizations

How to increase the list of results in my dashboard to display more than 1020 results?

svemurilv
Path Finder

Hi Team,
I have a Dashboard displaying the log events List of the specific date. When I am trying to displays all _raw events list, my dashboard shows only 1020 events count, is there any way to display complete raw log events in dashboard, without updating my Limits.conf file or some other .conf changes

using the search index=main source="/home/apps/loader/logs/$date_log$/$processname$" $loglevel$ "$search$"
-Thanks.

0 Karma

frobinson_splun
Splunk Employee
Splunk Employee

Hi @svemurilv,
Here is some documentation on configuring data truncation using the web.conf file and/or Simple XML:

http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/ChartDisplayissues#Data_truncation
http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/ChartDisplayissues#Configuration_file_data_tru...

Hope this helps!

0 Karma

rjthibod
Champion

You probably need to put | table _time _raw on the end of your query.

https://answers.splunk.com/answers/169448/splunk-search-limits-results-to-1000-events-only.html

0 Karma

svemurilv
Path Finder

yeah for both 6.2 and 6.5.1

0 Karma

svemurilv
Path Finder

This code is working

   <table>
    <search>
      <query>index=* source="/home/XXXXXXX/XXXXXX/logs/$date_log$/$processname$" $loglevel$ "$search$" | table _time _raw |sort +_time</query>
      <earliest>$time_sel.earliest$</earliest>
      <latest>$time_sel.latest$</latest>
      <sampleRatio>1</sampleRatio>
    </search>
    <option name="count">100</option>
    <option name="dataOverlayMode">none</option>
    <option name="drilldown">cell</option>
    <option name="percentagesRow">false</option>
    <option name="rowNumbers">false</option>
    <option name="totalsRow">false</option>
    <option name="wrap">true</option>
  </table>
0 Karma

rjthibod
Champion

in 6.5 correct?

0 Karma

svemurilv
Path Finder

Hi,
Am seeing same issues with staging which is running on latest 6.5.1 version.

-thanks

0 Karma

rjthibod
Champion

Hmm, strange. I don't see in 6.5 like I do in 6.2.

0 Karma

svemurilv
Path Finder

its bit old version 6.2

0 Karma

rjthibod
Champion

hmm, that maybe the issue. hold on.

0 Karma

rjthibod
Champion

Yes, mine gets truncated at 2000 lines on 6.2, and the total proparly depends on how big the raw events are.

You probably can't change this since it is likely limited in the JS stack, not inherent to the search head limits.

In general, there should be no reason for displaying that many raw events, because it will be impossible to find anything. I think you need to reconsider what you are doing with the data.

0 Karma

svemurilv
Path Finder

Same out pot no change its displaying only 1020 raw events , that's it

0 Karma

rjthibod
Champion

What version of Splunk are you using?

0 Karma

svemurilv
Path Finder
<panel>
  <event>
    <search>
      <query>   index=main source="/home/gdloader/gdloader/logs/$date_log$/$processname$" $loglevel$ "$search$"  | table _time _raw </query>
      <earliest>$time_sel.earliest$</earliest>
      <latest>$time_sel.latest$</latest>
       </search>
     </event>
</panel>
0 Karma

rjthibod
Champion

What happens if you add these options? How many pages of results do you see?

 <panel>
   <event>
     <search>
       <query>   index=main source="/home/gdloader/gdloader/logs/$date_log$/$processname$" $loglevel$ "$search$"  | table _time _raw </query>
       <earliest>$time_sel.earliest$</earliest>
       <latest>$time_sel.latest$</latest>
        </search>
        <option name="count">100</option>
        <option name="type">raw</option>
      </event>
 </panel>
0 Karma

svemurilv
Path Finder

Hi rjthibod
this doesn't help full to pull all my 6K events, again its showing 1020 events only instead of all events.

0 Karma

rjthibod
Champion

If I add an event table with raw results, I can retrieve thousands of events.

Please share your XML that you are using. Also, what version of Splunk?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...