Splunk Search

can't sort table results from a form search

dmlee
Communicator

Hi

I wrote a simple form search dashboard using <table> module .

I found if the number of results over 50,000 , when I click any label of table fields (for example : please refer to below source code , if I click the label said s_Seq , table module will sort whole result base on the content of s_Seq field) , the table won't sort results correctly , if the number of results is less then 50,000 , sort function works fine .

anyone know why ? thanks.

<?xml version="1.0" encoding="UTF-8"?>
<form>
    <fieldset>
        <input type="time" />
    </fieldset>
        <row>
            <table>
                <searchTemplate> sourcetype=abc Type=2 | where len(ProdId)&lt;10| dedup SeqNo | sort 0 SeqNo | delta SeqNo as diff | where diff&gt;1  | eval s_Seq=SeqNo-diff+1 | eval e_Seq=if(diff&gt;2,SeqNo-1,"")  | eval s_time=strftime(_time,"%Y/%m/%d %H:%M:%S.%3N") | eval lost=diff-1 </searchTemplate>
                <option name="count">10</option>
                <option name="showPager">true</option>
                <fields>s_time, s_Seq, e_Seq, lost</fields>
            </table>
        </row>
</form>
Tags (2)
0 Karma
1 Solution

dmlee
Communicator

this issue can be solved by using Sideview's module "Pager" , thanks Nick.

View solution in original post

0 Karma

dmlee
Communicator

this issue can be solved by using Sideview's module "Pager" , thanks Nick.

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...