Show in a Dashboard the first two pages of a table

[Elsurion]

Hi all
I have here a Kiosk Dashboard where i'm showing some hosts.
There are at the moment 34 hosts to show, but i have only space for 18 on the Dashboard. So i would like to have a way to show the second page of a table, since rare and top didn't work well, too many duplicated data.

Is there a way to say in the dashboard to show of a table the first and the second page?
Like a <option name="page">2</option>?
Either way in one <table> or with two <table>s, the referenced search is a global search.

Or could i say the search should only to list results 18 to 34?

Kind regards
Thomas

[Elsurion]

Since i can't add a screenshot, i'll try it with some sample explanation.
I have two tables on the dashboard based on the same search just with a top/rare select at the end, but when you compare workflow1 with workflow2 you'll see that host017 and host018 are duplicated and i liked a way to do that in one search where i can set the count to 18 and select paginator in one table to 1 and in the second to 2 that i get all entrys (34) in the dashboard without two searches.
And to mention, the 34 entrys might be today, tomorrow i could have 36 or 32 this is not fixed.

workflow1
host001
host002
host003
host004
host005
host006
host007
host008
host009
host010
host011
host012
host013
host014
host015
host016
host017
host018

workflow2
host034
host033
host032
host031
host030
host029
host028
host027
host026
host025
host024
host023
host022
host021
host020
host019
host018
host017

[cmerriman]

i would try what @niketnilay is recommending in the comments.

Other than that, you mentioned that top didn't work, I'd be curious to see your syntax because you might be able to use |sort - field_of_interest|head 25 or a variation of that to get the first 25 results based on field_of_interest. you could leave out the head command as well and keep all results sorted descending. you could also try tail 25 without the sort to get just the last 25 results.

http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Tail

you'll still want to check your formatting if you want it all on the same page to ensure that the number of rows is high enough to display them all: <option name="count">25</option>

[niketn]

@Elsurion, If number of rows in table is set to 18 you should have two pages in the table that you can click.

        <option name="count">18</option>

Following is a run anywhere dashboard snippet for the same.

  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd log_level!=INFO
| top 36 message showperc=f</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">18</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">true</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>

Please try out and confirm. If this is not what you want please add a mock screenshot of what you expect.