Splunk Search

How to dynamically change number of rows displayed in the table with simple XML using Splunk 6.1.x?

somesoni2
Revered Legend

I am using Splunk 6.1.2 and have a panel with a table developed in simple xml.

I would like to allow users to be able to choose the number of rows displayed in the table.

I know that with write permissions, users can do Edit->Edit Panel->Table formatting and change the number of rows to be displayed, but I want to just read access to dashboard and maybe have a drop-down with values 5,10,15,20,50,100 and it should be used a no of rows displayed in the table.

I tried with a drop-down with above values and tried to set the "count" property with the drop-down token like below:

<option name="count">$noofrows$</option>

But this gives errors below error on saving launching

XML Syntax Error: invalid literal for int() with base 10: '$noofrows$'

Has anyone done something similar or have any better way to do it?

Thanks in advanced.

niketn
Legend

@somesoni2, I just tested this in Splunk Enterprise 7 and I was able to pass Number of Rows value from Dropdown to Table Simple XML configurationi.e. <option name="count">$tokRows$</option>. Not sure which version it was fixed. Following is run any where dashboard for testing.

<form>
  <label>Table number of rows via token</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="tokRows" searchWhenChanged="true">
      <label>Number Of Rows</label>
      <choice value="5">5</choice>
      <choice value="10">10</choice>
      <choice value="20">20</choice>
      <choice value="30">30</choice>
      <default>5</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd log_level=*
|  stats count by component log_level</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">$tokRows$</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

Nextbeat
Path Finder

I was able to get this working in 6.6.3, but not in 6.3.1.

<form>
  <label></label>
  <row>
    <panel>     
     <input type="text" token="row_tok" searchWhenChanged="true">
       <label>Number Of Rows</label>
       <default>10</default>
     </input>
    </panel>
  </row>
  <row>
    <panel>
     <table>
        <search>
          <query></query>
        </search>
        <option name="count">$row_tok$</option>
      </table>
    </panel>
  </row>
</form>
0 Karma

apchandler
New Member

Old post, but I was just trying to do something similar and wanted to share what I came up with.

My Use Case:
Table A and Table B are side-by-side on the same dashboard row. Table A will always show every row (between 15 and 40), but Table B will have hundreds of rows. I wanted the maximum rows of Table B to be dynamically constrained to the currently-displayed row count of Table A.

My Solution:

Table A:
<search>
 <query>blahBlah</query>
 <done>
  <eval token="rowsTableA">tonumber('job.resultCount')</eval>
 </done>
</search>

Table B:
<option name="count">$rowsTableA$</option>

Hope this might help someone if you're in a similar situation! 🙂

0 Karma

arathig
Explorer

I downvoted this post because will not help - when the count is evaluated to more than 100

0 Karma

arathig
Explorer

If rowsTableA is evaluated to a value more then 100 - that this wont work. It defaults to show just 20 records in the table

0 Karma

kasu_praveen
Communicator

Any solution for this? Trying to control number of rows displayed per page dynamically (With dropdown selected value)

0 Karma

DaveAW
Engager

Add another vote. tonumber($noofrows$) doesn't work either.

0 Karma

Lucas_K
Motivator

Did you ever find a working solution to this? The error still occurs as of v6.2.3

I'm trying to do the same thing (and hence finding this unanswered post!).

0 Karma

akazarov
Path Finder

Same here. A solution would be appreciated.

0 Karma

jitsinha
Path Finder

Hii Somesh,

If you are using a Table command to populate the statistics table then I would suggest to do the following ,

Dropdown :

*<input type="dropdown" token="rowNo" searchWhenChanged="true">
  <default>10</default>
  <choice value="10">10</choice>
  <choice value="20">20</choice>
  <choice value="30">30</choice>
</input>

*Search Query to populate the table: * index = my_index | table a, b , c | head $rowNo$

spammenot66
Contributor

@jitsinha this is a nice solution for dynamically displaying top # of rows. I think Somesh and the rest of us are trying to determine if there's a way to dynamically change the number of rows per page

Currently this needs to be hard coded to be a specific integer number

<table>
...
...
<option name="count">10</option>
</table>

it would be nice if we could have it be dynamically driven by a token

<table>
...
...
<option name="count">$dispRows_tok$</option>
</table>

im guessing its not possible, but it would be nice to have in future updates.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

&#x1f342; Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...