Splunk Search

How to dynamically change number of rows displayed in the table with simple XML using Splunk 6.1.x?

somesoni2
SplunkTrust
SplunkTrust

I am using Splunk 6.1.2 and have a panel with a table developed in simple xml.

I would like to allow users to be able to choose the number of rows displayed in the table.

I know that with write permissions, users can do Edit->Edit Panel->Table formatting and change the number of rows to be displayed, but I want to just read access to dashboard and maybe have a drop-down with values 5,10,15,20,50,100 and it should be used a no of rows displayed in the table.

I tried with a drop-down with above values and tried to set the "count" property with the drop-down token like below:

<option name="count">$noofrows$</option>

But this gives errors below error on saving launching

XML Syntax Error: invalid literal for int() with base 10: '$noofrows$'

Has anyone done something similar or have any better way to do it?

Thanks in advanced.

niketn
Legend

@somesoni2, I just tested this in Splunk Enterprise 7 and I was able to pass Number of Rows value from Dropdown to Table Simple XML configurationi.e. <option name="count">$tokRows$</option>. Not sure which version it was fixed. Following is run any where dashboard for testing.

<form>
  <label>Table number of rows via token</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="tokRows" searchWhenChanged="true">
      <label>Number Of Rows</label>
      <choice value="5">5</choice>
      <choice value="10">10</choice>
      <choice value="20">20</choice>
      <choice value="30">30</choice>
      <default>5</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd log_level=*
|  stats count by component log_level</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">$tokRows$</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

Nextbeat
Path Finder

I was able to get this working in 6.6.3, but not in 6.3.1.

<form>
  <label></label>
  <row>
    <panel>     
     <input type="text" token="row_tok" searchWhenChanged="true">
       <label>Number Of Rows</label>
       <default>10</default>
     </input>
    </panel>
  </row>
  <row>
    <panel>
     <table>
        <search>
          <query></query>
        </search>
        <option name="count">$row_tok$</option>
      </table>
    </panel>
  </row>
</form>
0 Karma

apchandler
New Member

Old post, but I was just trying to do something similar and wanted to share what I came up with.

My Use Case:
Table A and Table B are side-by-side on the same dashboard row. Table A will always show every row (between 15 and 40), but Table B will have hundreds of rows. I wanted the maximum rows of Table B to be dynamically constrained to the currently-displayed row count of Table A.

My Solution:

Table A:
<search>
 <query>blahBlah</query>
 <done>
  <eval token="rowsTableA">tonumber('job.resultCount')</eval>
 </done>
</search>

Table B:
<option name="count">$rowsTableA$</option>

Hope this might help someone if you're in a similar situation! 🙂

0 Karma

arathig
Explorer

I downvoted this post because will not help - when the count is evaluated to more than 100

0 Karma

arathig
Explorer

If rowsTableA is evaluated to a value more then 100 - that this wont work. It defaults to show just 20 records in the table

0 Karma

kasu_praveen
Communicator

Any solution for this? Trying to control number of rows displayed per page dynamically (With dropdown selected value)

0 Karma

DaveAW
Engager

Add another vote. tonumber($noofrows$) doesn't work either.

0 Karma

Lucas_K
Motivator

Did you ever find a working solution to this? The error still occurs as of v6.2.3

I'm trying to do the same thing (and hence finding this unanswered post!).

0 Karma

akazarov
Path Finder

Same here. A solution would be appreciated.

0 Karma

jitsinha
Path Finder

Hii Somesh,

If you are using a Table command to populate the statistics table then I would suggest to do the following ,

Dropdown :

*<input type="dropdown" token="rowNo" searchWhenChanged="true">
  <default>10</default>
  <choice value="10">10</choice>
  <choice value="20">20</choice>
  <choice value="30">30</choice>
</input>

*Search Query to populate the table: * index = my_index | table a, b , c | head $rowNo$

spammenot66
Contributor

@jitsinha this is a nice solution for dynamically displaying top # of rows. I think Somesh and the rest of us are trying to determine if there's a way to dynamically change the number of rows per page

Currently this needs to be hard coded to be a specific integer number

<table>
...
...
<option name="count">10</option>
</table>

it would be nice if we could have it be dynamically driven by a token

<table>
...
...
<option name="count">$dispRows_tok$</option>
</table>

im guessing its not possible, but it would be nice to have in future updates.

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...