Can I increase the display of results on the left nav after a search from the top 10? For example, when I do a search, it shows that there are 19 hosts, but I can only see the top 10. I would like to be able to see all of them.
The number of top values shown, for each field is not configurable. There is a workaround but it's not recommended as it involves updating core code of Splunk and any upgrade of Splunk will overwrite it.
To expand on the above for the less experienced - if you wish to increase the number of results shown when you click on a field you need to edit this file:
{splunk install}/share/splunk/search_mrsparkle/modules/results/SuggestedFieldViewer.conf
and add a stansa:
[param:count]
required = False
default = 20
As that this is not a documented feature of the product it's also probably liable to change in future releases without notice. The value of your investment could go up as well as down.
search query | top limit=20 host
This will show you the top 20 hosts
...
Realized this is not what you asked check this:
https://answers.splunk.com/answers/7298/increase-top-10-field-values-in-search-app-increase-limits-o...
Thanks for the reply but that does not really accomplish what I am looking for. I would like all of the items under the "selected fields" on the left nav to show all items when I click on it, not just the top 10. Is there no global setting there? How do I get to see the other hosts in that dialog when I click on "hosts" for example?