embedded tables limited to 20 rows ?

[sdeveen]

I use some embedded reports and they work fine. Now i made an upgrade to Version 6.3 and a Searchhead-Cluster. Now embedded tables (that worked before) show only 20 rows. Any ideas how to fix this or is this a known bug ?

[andygerber]

You can use streamstats to chop your results into multiple embedded searches, if that works.
Then embed the multiple URLs where you want them. Not a perfect solution.

For instance, if you always had fewer than 60 results, you could use the following snippets.

|  streamstats count as row_num
|  where row_num < 21
| fields – row_num

|  where row_num >20 AND row_num < 41

|  where row_num >40

[the_wolverine]

In version 6.6* and 7, it looks like the limit to table rows has been reduced to 10.

"Embedded reports do not have all the features of reports as viewed in Splunk Web. For example, embedded reports do not have drilldown functionality, support for workflow actions, table sorting, or field expansion. When embedded reports display table visualizations, those tables are limited to 10 rows. "

[sdeveen · Accepted solution]

Meanwhile we received a reply from the support-team:

"We currently have a bug open for this issue. (SPL-109078)
The developers are pushing the fix into the next major release, since fixing this would be a visible change. I don't yet know what version it will be included in.
At this time, there is no workaround for this."

[jkat54]

If you look at this example, there is a rowNumbers json element in the html. Search for rowNumbers.

http://dev.splunk.com/view/SP-CAAAE5Q

[sdeveen]

Thanks, but this example shows a dashboard. That will work as a workaround, but the embedded reports worked before we've build a seachrheadcluster with Version 6.3.

[jkat54]

Have you tried rebuilding the embedded reports after the cluster was built?

Maybe some local settings are configured, etc.

[sdeveen]

Yes, i rebuilded the report. And i made some new testreports to embed them. They all show just 20 rows.

[lyc1986830]

I still hit this issue in splunk 6.6.1. Is this bug fixed in any new version or any plan to fix this?

[the_wolverine]

https://docs.splunk.com/Documentation/Splunk/7.0.3/Report/Embedscheduledreports

"Embedded reports do not have all the features of reports as viewed in Splunk Web. For example, embedded reports do not have drilldown functionality, support for workflow actions, table sorting, or field expansion. When embedded reports display table visualizations, those tables are limited to 10 rows. "