Dashboards & Visualizations

showPager and count values not being respected

SplunkTrust
SplunkTrust

Hello,

I've created a custom dashboard with specific count and showPager option values for each table on the dashboard. However when I load the dashboard they do not seem to be respected. If I set the count to 10 and showpager to true, I'll still get 42 results in the table.

My only thought is that for my user when I search I have set the return value of 50 results per page. Could this be carrying over onto the dashboard? If so, how would you override it?

Thanks.

Tags (3)
1 Solution

SplunkTrust
SplunkTrust

No, that 50 wont carry over from the search view's preferences over into the dashboard.

Could you paste in the simplified XML that you're using?

For what it's worth I just copied some XML from search_status.xml in the search app and tried out showPager and count and they seem to work as expected. See below.

<row>
    <table>
      <title>Recent searches by expense (last hour)</title>
      <searchString>`audit_searchlocal` |  convert num(total_run_time) | eval user = if(user="n/a", null(), user) | `audit_rexsearch` | eval is_scheduled = if(search_id LIKE "scheduler%", "yes", "no") | stats min(_time) as _time first(user) as user first(total_run_time) as total_run_time first(search) as search first(is_scheduled) as is_scheduled by search_id | search user=* | sort - total_run_time</searchString> 
      <earliestTime>-1h</earliestTime>
      <fields>_time,user,is_scheduled,total_run_time,search</fields>
      <option name="showPager">true</option>
      <option name="count">5</option>
    </table>
  </row>

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

No, that 50 wont carry over from the search view's preferences over into the dashboard.

Could you paste in the simplified XML that you're using?

For what it's worth I just copied some XML from search_status.xml in the search app and tried out showPager and count and they seem to work as expected. See below.

<row>
    <table>
      <title>Recent searches by expense (last hour)</title>
      <searchString>`audit_searchlocal` |  convert num(total_run_time) | eval user = if(user="n/a", null(), user) | `audit_rexsearch` | eval is_scheduled = if(search_id LIKE "scheduler%", "yes", "no") | stats min(_time) as _time first(user) as user first(total_run_time) as total_run_time first(search) as search first(is_scheduled) as is_scheduled by search_id | search user=* | sort - total_run_time</searchString> 
      <earliestTime>-1h</earliestTime>
      <fields>_time,user,is_scheduled,total_run_time,search</fields>
      <option name="showPager">true</option>
      <option name="count">5</option>
    </table>
  </row>

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Ok, thanks for your help. I haven't had much experience with the Advanced XML yet...where might I find some good reading on this?

0 Karma

SplunkTrust
SplunkTrust

It definitely sounds like a bug. I would email support@splunk that you've found a bug in the simplified XML. In the meantime I would convert your view to the Advanced XML and whatever it is you wont suffer the problem there.

0 Karma

SplunkTrust
SplunkTrust

Yup it looks like that works now.

So I guess it has to do with something carrying over from the saved search?

0 Karma

SplunkTrust
SplunkTrust

Hmm. If you manually copy the search out of the saved search and replace it in as 'searchString', does it work then?

0 Karma

SplunkTrust
SplunkTrust

Hey nick, thanks for your reply. Could it be that since I'm using a saved search this is why Im getting the 50 results?

Here is a sample of my XML:

<table>
<searchName>INTERNAL - FAS Func Avg Exec Times Last 24hrs</searchName>
<title>FAS Web App - Avg Function Exec Times (Last 24hrs)</title>
<option name="count">10</option>
<option name="displayRowNumbers">true</option>
<option name="drilldown">none</option>
<option name="showPager">true</option>
</table>
0 Karma