Splunk Search

embedded tables limited to 20 rows ?

sdeveen
Explorer

I use some embedded reports and they work fine. Now i made an upgrade to Version 6.3 and a Searchhead-Cluster. Now embedded tables (that worked before) show only 20 rows. Any ideas how to fix this or is this a known bug ?

1 Solution

sdeveen
Explorer

Meanwhile we received a reply from the support-team:

"We currently have a bug open for this issue. (SPL-109078)
The developers are pushing the fix into the next major release, since fixing this would be a visible change. I don't yet know what version it will be included in.
At this time, there is no workaround for this."

View solution in original post

andygerber
Path Finder

You can use streamstats to chop your results into multiple embedded searches, if that works.
Then embed the multiple URLs where you want them. Not a perfect solution.

For instance, if you always had fewer than 60 results, you could use the following snippets.

|  streamstats count as row_num
|  where row_num < 21
| fields – row_num

|  where row_num >20 AND row_num < 41

|  where row_num >40
0 Karma

the_wolverine
Champion

In version 6.6* and 7, it looks like the limit to table rows has been reduced to 10.

"Embedded reports do not have all the features of reports as viewed in Splunk Web. For example, embedded reports do not have drilldown functionality, support for workflow actions, table sorting, or field expansion. When embedded reports display table visualizations, those tables are limited to 10 rows. "

0 Karma

sdeveen
Explorer

Meanwhile we received a reply from the support-team:

"We currently have a bug open for this issue. (SPL-109078)
The developers are pushing the fix into the next major release, since fixing this would be a visible change. I don't yet know what version it will be included in.
At this time, there is no workaround for this."

jkat54
SplunkTrust
SplunkTrust

If you look at this example, there is a rowNumbers json element in the html. Search for rowNumbers.

http://dev.splunk.com/view/SP-CAAAE5Q

0 Karma

sdeveen
Explorer

Thanks, but this example shows a dashboard. That will work as a workaround, but the embedded reports worked before we've build a seachrheadcluster with Version 6.3.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Have you tried rebuilding the embedded reports after the cluster was built?

Maybe some local settings are configured, etc.

0 Karma

sdeveen
Explorer

Yes, i rebuilded the report. And i made some new testreports to embed them. They all show just 20 rows.

0 Karma

lyc1986830
New Member

I still hit this issue in splunk 6.6.1. Is this bug fixed in any new version or any plan to fix this?

0 Karma

the_wolverine
Champion

https://docs.splunk.com/Documentation/Splunk/7.0.3/Report/Embedscheduledreports

"Embedded reports do not have all the features of reports as viewed in Splunk Web. For example, embedded reports do not have drilldown functionality, support for workflow actions, table sorting, or field expansion. When embedded reports display table visualizations, those tables are limited to 10 rows. "

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...