Splunk Search

How to display a table that shows all rows without pagination?

marxsabandana
Path Finder

I need to display a table that will show all the rows without pagination. I have already tried using "showPager" option in XML but it just removed the pagination and still displays 100 rows only. Is there a way to set the row count to unlimited?

0 Karma

niketn
Legend

[UPDATED Code works in 7.2.6 but not on 7.3.0]

Just found out that while this worked in 7.2.6, it does not work in 7.3.0. Something is broken because it does not work in intended way anymore. So, Simple XML JS extension will be required to read the $job.resultCount$ token and render table with same number of rows and hence remove pagination.


@marxsabandana try the following run anywhere dashboard example using Simple XML which gets the result count from the search result using default search token $job.resultCount$ that needs to be populated in the table,

 <done>
   <set token="tokRowsPerPage">$job.resultCount$</set>
 </done>

Then passes the count to the table option:

<option name="count">$tokRowsPerPage$</option>`

PS:
1) Post processing using search id srchForTbl has been used to get the result count from search and then add the dependency of token tokRowsPerPage to the table so that the table renders only after the token is set.
2) I have used | fields - $tokRowsPerPage$ for adding token dependency to the table search however, you can use comment macro instead.
3) If you know an upper limit of table with all the records you can set the same using <init> section to set the token in the dashboard and step 1 with post processing will not be required.
4) This would work on Splunk 6.5 or higher.
Following is the complete Simple XML code for the run anywhere example.

 <form>
  <label>Table Pagination</label>
  <search id="srchForTbl">
    <query>index=_internal sourcetype=splunkd log_level!=INFO
| timechart span=5m count by component limit=5 useother=f
| streamstats count as sno
| fields sno *</query>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
    <sampleRatio>1</sampleRatio>
    <done>
      <set token="tokRowsPerPage">$job.resultCount$</set>
    </done>
  </search>
  <fieldset submitButton="false"></fieldset>
  <row>
    <panel>
      <input type="text" token="testTextBox" searchWhenChanged="true">
        <label>(Testing) Rows per page based on Search Result</label>
        <default>$tokRowsPerPage$</default>
      </input>
      <table>
        <search base="srchForTbl">
          <query>| fields - $tokRowsPerPage$</query>
        </search>
        <option name="count">$tokRowsPerPage$</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

Please try out and confirm!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

vnravikumar
Champion
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...