SimpleResultsTable ignoring number of results to display

[rturk]

Greetings Splunkers!

I'm trying to get SimpleResultsTable to constrain the number of displayed results to 10 results, with a paginator allowing me to browse to other results. Sounds pretty simple, but it only ever shows the default of 50 results per table, ignoring my setting of 10. Here's my one and only module (chrome omitted):

<module name="HiddenSavedSearch" layoutPanel="panel_row1_col1" autoRun="True">
    <param name="savedSearch">rim_top_alarming_rims</param>
    <param name="groupLabel">Top Alarming RIM ID's</param>
    <module name="ViewstateAdapter">

        <param name="savedSearch">rim_top_alarming_rims</param>
        <module name="HiddenFieldPicker">
            <param name="strictMode">True</param>
            <module name="JobProgressIndicator">
                <module name="Paginator">
                    <param name="count">10</param>
                    <param name="entityName">results</param>
                    <module name="EnablePreview">
                        <param name="enable">True</param>
                        <param name="display">False</param>
                        <module name="SimpleResultsTable">
                            <param name="count">10</param>
                            <param name="drilldown">row</param>
                            <param name="allowTransformedFieldSelect">True</param>
                            <module name="ConvertToDrilldownSearch">
                                <module name="ViewRedirector">
                                    <param name="viewTarget">flashtimeline</param>
                                </module>
                            </module>
                        </module>
                        <module name="ViewRedirectorLink">
                            <param name="viewTarget">flashtimeline</param>
                        </module>
                    </module>
                </module>
            </module>
        </module>
    </module>
</module>

I did do a simple XML to advanced XML conversion with the '?showsource=1' trick, but comparisons between my code and other working code has me utterly confused as to why this doesn't work.

The module reference for SimpleResultsTable says on the count parameter: "This determines the number of events to display per page. Note this is almost always overridden by other modules that can set this from above."

Except this is the only module, so I can't see where it would be overwritten from?

Any help greatly appreciated and upvotes will be forthcoming 🙂

[rturk · Accepted solution]

Wow.

I just figured it out. When I put together the saved search from the 'flashtimeline' page, I had the 'Results per page' dropdown box set to 50. Apparently this setting is saved along with the timeframe and the search itself, however this isn't reflected in the GUI Manager >> Searches and reports >> saved_search_name settings.

This in turn was where the SimpleResultsTable was having is 'count' value over-ridden from.

I couldn't find any reference to the number of results to display in the savedsearch.conf either. I'm running 4.2.5, so I'll test it with the latest version to see if it's there and log a bug if it is.

EDIT: I think whatever page a search/report is constructed in (eg. flashtimeline or report_builder_display) will determine the CSS to be used by the search/report regardless of where it is displayed (eg. embedding one of these saved searches in a custom dashboard will use the settings of the origin page). This is less of a bug, more of a gotcha, but the behaviour is not intuitive so I'm keeping the bug tag.

[sideview]

Yep. Technically this is one of the args that gets filed away in the 'viewstate', and the viewstate stanza gets associated with the saved search. There are not many intuitive things about viewstates.