Splunk Search

SimpleResultsTable ignoring count

kjcorbin
Explorer

I have search and post-process that is returning a data table. The post process adds column totals to the table. The problem is the totals are not showing up. It appears the issue is with the SimpleResultsTable it is only displaying 19 rows even though the count and maxLines values are set to 25. If I sort the table my count descending the totals show up at the top so it looks like the totals are generating, but you cannot see them when the dashboard loads because the SimpleResutlsTable is seemingly choosing and arbitrary number of rows to show. If I remove the count line the results returns to 10 rows as I would expect. So I am not sure it is only showing 19 rows when the count is set to 25.

  <module name="HiddenSavedSearch" layoutPanel="panel_row6_col1" autoRun='True'>
     <param name="savedSearch">7_day_summary</param>
     <param name="useHistory">True</param>
     <module name="HiddenPostProcess" layoutPanel="panel_row6_col1" group="Full Data">
        <param name="search"> addcoltotals label=Totals labelfield=ServiceName|fields ServiceName PlayHours PlayErrorsTotal OtherErrors Tracks Search Browse Households | rename ServiceName as "Service Name"|rename PlayHours as "Play Hours" PlayErrorsTotal as "Play Errors" OtherErrors as "Other Errors" Households as "Unique Households"</param>
       <module name="JobProgressIndicator"/>
           <module name="SimpleResultsTable">
                <param name="count">25</param>
                <param name="maxLines">25</param>
               <param name="drilldown">all</param>
            </module>
        <module name="ViewRedirectorLink">
           <param name="viewTarget">flashtimeline</param>
          <param name="label">View Results</param>
       </module>
   </module>
1 Solution

kjcorbin
Explorer

I ended up solving this by adding the totals to the original query. However, because I was sharing the search node with other charts that were displaying averages and top usage I had to exclude the Totals from the data on the other post-process steps.

I did this by adding:
search NOT ServiceName="Totals" |

View solution in original post

0 Karma

kjcorbin
Explorer

I ended up solving this by adding the totals to the original query. However, because I was sharing the search node with other charts that were displaying averages and top usage I had to exclude the Totals from the data on the other post-process steps.

I did this by adding:
search NOT ServiceName="Totals" |

View solution in original post

0 Karma

sideview
SplunkTrust
SplunkTrust

Just to ask the obvious question -- are you sure it isnt just that your search results only have 19 rows for this search? or 18 if you dont count the 'Total' row?

0 Karma

kjcorbin
Explorer

yes I am sure, if I run the same search outside of the dashboard I can see all results and totals correctly.

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.