- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: How to visualize more than 100 rows in a table...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to visualize more than 100 rows in a table in the dashboard?
Hi,
I'm using the following option for a table in a dashboard:
<option name="count">xx</option>
and it successfully changes the number of displayed rows from 10 to xx, but only up to 100. If I try to specify a value for count that is bigger than 100, it defaults back to 10, not accepting the new count. (100 seems to be the hardcoded limit for the number of rows that can be visualized in a table)
Is there a way to remove this limitation and visualize more than 100 rows?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
you can split the table by using streamstats:
row 1:
| your search
| streamstats count as numOfEvents
| where numOfEvents<101
<option name="count">100</option>
row 2:
For the next 100 rows
| your search
| streamstats count as numOfEvents
| where numOfEvents<201
<option name="count">100</option>
etc.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is there any way to view more than 100 rows in table, please let me know.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
try:
<option name="count">0</option>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
is possible in HTML?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
¿Hi did you find out a solution?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have tried 0 (even -1), but still no luck 😕 It defaults to 10
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @jojocalman are you able to solve this issue? 🙂
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
