The search is nothing special. It ends with a stats command showing avg, median, p95 and max values. In Splunk 5, where I crafted and saved the search initially, it results in a table. That's what I wanted. In Splunk 6, it shows a column chart on the top of the page, with the table underneath. With so many entries in the table, the column chart is useless.
There aren't any options for controlling this behavior in the saved search edit page. Nor any widgets to hide the graph on the results page.
How do I make the saved search return only the table?
The saved search is:
index=iislog | eval uri=upper(uri) | rex field=referer "(?i)https?://(?<refhost>[^:/]+)"| stats count p95(rtt) as p95 by dc refhost version | where count>1000 | stats list(dc) as DC list(version) as Version list(count) as Pageviews list(p95) as "95th% RTT" by refhost
EDIT: All of my saved searches are doing this. Any saved search that results in a table is now resulting in a graph and a table. Bah, I really don't want to create views for each of these. Is there anyway to turn off this behavior?
It seemed to work... when clicking run from the Management page it did. But when I select the saved search from the menu i still get the graph. Bugga. Thanks for trying.