Splunk Search

How to display a table that shows all rows without pagination?

marxsabandana
Path Finder

I need to display a table that will show all the rows without pagination. I have already tried using "showPager" option in XML but it just removed the pagination and still displays 100 rows only. Is there a way to set the row count to unlimited?

0 Karma

niketn
Legend

[UPDATED Code works in 7.2.6 but not on 7.3.0]

Just found out that while this worked in 7.2.6, it does not work in 7.3.0. Something is broken because it does not work in intended way anymore. So, Simple XML JS extension will be required to read the $job.resultCount$ token and render table with same number of rows and hence remove pagination.


@marxsabandana try the following run anywhere dashboard example using Simple XML which gets the result count from the search result using default search token $job.resultCount$ that needs to be populated in the table,

 <done>
   <set token="tokRowsPerPage">$job.resultCount$</set>
 </done>

Then passes the count to the table option:

<option name="count">$tokRowsPerPage$</option>`

PS:
1) Post processing using search id srchForTbl has been used to get the result count from search and then add the dependency of token tokRowsPerPage to the table so that the table renders only after the token is set.
2) I have used | fields - $tokRowsPerPage$ for adding token dependency to the table search however, you can use comment macro instead.
3) If you know an upper limit of table with all the records you can set the same using <init> section to set the token in the dashboard and step 1 with post processing will not be required.
4) This would work on Splunk 6.5 or higher.
Following is the complete Simple XML code for the run anywhere example.

 <form>
  <label>Table Pagination</label>
  <search id="srchForTbl">
    <query>index=_internal sourcetype=splunkd log_level!=INFO
| timechart span=5m count by component limit=5 useother=f
| streamstats count as sno
| fields sno *</query>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
    <sampleRatio>1</sampleRatio>
    <done>
      <set token="tokRowsPerPage">$job.resultCount$</set>
    </done>
  </search>
  <fieldset submitButton="false"></fieldset>
  <row>
    <panel>
      <input type="text" token="testTextBox" searchWhenChanged="true">
        <label>(Testing) Rows per page based on Search Result</label>
        <default>$tokRowsPerPage$</default>
      </input>
      <table>
        <search base="srchForTbl">
          <query>| fields - $tokRowsPerPage$</query>
        </search>
        <option name="count">$tokRowsPerPage$</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

Please try out and confirm!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

vnravikumar
Champion
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...