Saved Search in Splunk 5 produces a table, but in Splunk 6 a column chart and table. Why?

[twinspop]

The search is nothing special. It ends with a stats command showing avg, median, p95 and max values. In Splunk 5, where I crafted and saved the search initially, it results in a table. That's what I wanted. In Splunk 6, it shows a column chart on the top of the page, with the table underneath. With so many entries in the table, the column chart is useless.

There aren't any options for controlling this behavior in the saved search edit page. Nor any widgets to hide the graph on the results page.

How do I make the saved search return only the table?

The saved search is:

 index=iislog | eval uri=upper(uri) | rex field=referer "(?i)https?://(?<refhost>[^:/]+)"| stats count p95(rtt) as p95 by dc refhost version | where count>1000 | stats list(dc) as DC list(version) as Version list(count) as Pageviews list(p95) as "95th% RTT" by refhost

What it looks like in Splunk 6

EDIT: All of my saved searches are doing this. Any saved search that results in a table is now resulting in a graph and a table. Bah, I really don't want to create views for each of these. Is there anyway to turn off this behavior?

[Simon_Fishel · Accepted solution]

• from the page where you're viewing the report, select Edit -> Open In Search
• once you land in Search, click Save (if it's greyed out you may have to make a meaningless change)
• in the dialog that comes up, select "None" for "Visualization" and save it

[coleman07]

Is there a solution to this problem so we don't have to do this?

[richgalloway]

Try adding '| table DC, Version, Pageviews, "95th% RTT"' to the end of your search.

[twinspop]

It seemed to work... when clicking run from the Management page it did. But when I select the saved search from the menu i still get the graph. Bugga. Thanks for trying.