Splunk Search

Saved Search in Splunk 5 produces a table, but in Splunk 6 a column chart and table. Why?

Influencer

The search is nothing special. It ends with a stats command showing avg, median, p95 and max values. In Splunk 5, where I crafted and saved the search initially, it results in a table. That's what I wanted. In Splunk 6, it shows a column chart on the top of the page, with the table underneath. With so many entries in the table, the column chart is useless.

There aren't any options for controlling this behavior in the saved search edit page. Nor any widgets to hide the graph on the results page.

How do I make the saved search return only the table?

The saved search is:

 index=iislog | eval uri=upper(uri) | rex field=referer "(?i)https?://(?<refhost>[^:/]+)"| stats count p95(rtt) as p95 by dc refhost version | where count>1000 | stats list(dc) as DC list(version) as Version list(count) as Pageviews list(p95) as "95th% RTT" by refhost

What it looks like in Splunk 6

EDIT: All of my saved searches are doing this. Any saved search that results in a table is now resulting in a graph and a table. Bah, I really don't want to create views for each of these. Is there anyway to turn off this behavior?

1 Solution

Splunk Employee
Splunk Employee
  • from the page where you're viewing the report, select Edit -> Open In Search
  • once you land in Search, click Save (if it's greyed out you may have to make a meaningless change)
  • in the dialog that comes up, select "None" for "Visualization" and save it

View solution in original post

Splunk Employee
Splunk Employee
  • from the page where you're viewing the report, select Edit -> Open In Search
  • once you land in Search, click Save (if it's greyed out you may have to make a meaningless change)
  • in the dialog that comes up, select "None" for "Visualization" and save it

View solution in original post

Communicator

Is there a solution to this problem so we don't have to do this?

0 Karma

SplunkTrust
SplunkTrust

Try adding '| table DC, Version, Pageviews, "95th% RTT"' to the end of your search.

---
If this reply helps you, an upvote would be appreciated.

Influencer

It seemed to work... when clicking run from the Management page it did. But when I select the saved search from the menu i still get the graph. Bugga. Thanks for trying.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!