Splunk Search

Simple XML view only shows 10 results in table

Path Finder

I have a dashboard/view that is built using simple XML. There are tables on this view that are built from saved searches. The searches have the following code in them:

... | chart max(bytes) limit=20 by server

The table from the resulting search only shows 10 results. Changing the limit=0 does not change this, and using the search code (as opposed to a saved search) does not affect this either. If I run the search by itself, I can change the number of result per page, but that does not seem to be available using simple XML.

Is there something I can do, other than possibly rewrite the view using advanced XML that will allow this table to show more than 10 results?

Tags (2)
0 Karma

Contributor

Drainy,

Is possible insert the value for this field using a variable ? Like this: $count$. Say this, because I have one dashboard that has a field like a joker.

Regards,

RM

0 Karma

Champion

You can edit the simple XML and inside the

block add;

<option name="count">X number of rows</option>

Also, for more detail see here

Have a look here. Through simple XML you can define fields so you may not need to pipe to table at all, does it throw an error if you omit the table search command and just use a normal search inside the table xml as explained in that link?

Path Finder

Thanks. I'll look into the fields enumeration.

0 Karma

Champion

probably not. In fairness I am used to advanced XML. See my updated answer above

0 Karma

Path Finder

Piping stats into table still doesn't increase the number of rows displayed in my view, but does seem to work in a regular search window. Is it possible this is a bug?

0 Karma

Champion

oh you're using chart. change chart to stats and then pipe to table, e.g stats max(bytes) by server | table field,field2 limit=20 <- that might do it

0 Karma

Path Finder

Thanks, Draineh. I've tried your recommended option, but I get the following error message when I refresh the view:
"The following options were specified but have no effect when a split-by clause is not provided:limit,"

We definitely have more than 10 servers that should be visible by this search. If you click the "view results" link, you can see there are 16 results, but unless you change the number of results per page (in that dropdown item), you get 10 at first. Any further recommendations?

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!