I have a dashboard/view that is built using simple XML. There are tables on this view that are built from saved searches. The searches have the following code in them:
... | chart max(bytes) limit=20 by server
The table from the resulting search only shows 10 results. Changing the limit=0 does not change this, and using the search code (as opposed to a saved search) does not affect this either. If I run the search by itself, I can change the number of result per page, but that does not seem to be available using simple XML.
Is there something I can do, other than possibly rewrite the view using advanced XML that will allow this table to show more than 10 results?
Drainy,
Is possible insert the value for this field using a variable ? Like this: $count$
. Say this, because I have one dashboard that has a field like a joker.
Regards,
RM
You can edit the simple XML and inside the
Thanks. I'll look into the fields enumeration.
probably not. In fairness I am used to advanced XML. See my updated answer above
Piping stats into table still doesn't increase the number of rows displayed in my view, but does seem to work in a regular search window. Is it possible this is a bug?
oh you're using chart. change chart to stats and then pipe to table, e.g stats max(bytes) by server | table field,field2 limit=20 <- that might do it
Thanks, Draineh. I've tried your recommended option, but I get the following error message when I refresh the view:
"The following options were specified but have no effect when a split-by clause is not provided:limit,"
We definitely have more than 10 servers that should be visible by this search. If you click the "view results" link, you can see there are 16 results, but unless you change the number of results per page (in that dropdown item), you get 10 at first. Any further recommendations?