Splunk Search

How to dynamically change the number of rows in a table - This was working using input token in 6.6.1, now is unreliable in 7.2

nzsci
New Member

I have been using inputs to allow users to select the number of rows in a table.

This has been working well, with no issues in Splunk 6.6.

An example of how I have been using code:

 <fieldset submitButton="false">
        <input type="dropdown" token="rowNo" searchWhenChanged="true">
          <label>No. of rows</label>
          <choice value="5">5</choice>
          <choice value="10">10</choice>
          <choice value="20">20</choice>
          <choice value="50">50</choice>
          <default>20</default>
        </input>
      </fieldset>
      <row>
        <panel>
          <table>
            <search>
              <query>index=tutorial | stats count by file method status</query>
              <earliest>0</earliest>
              <sampleRatio>1</sampleRatio>
            </search>
            <option name="count">$rowNo$</option>
            <option name="dataOverlayMode">none</option>
            <option name="drilldown">none</option>
            <option name="percentagesRow">false</option>
            <option name="rowNumbers">false</option>
            <option name="totalsRow">false</option>
            <option name="wrap">true</option>
            <option name="showPager">true</option>
          </table>
        </panel>
      </row>

Since upgrading to Splunk 7 this row change input is no longer reliable. It sometimes works and sometimes doesn't. Occasionally I will get an "Invalid count" error in the table, but generally there is no indication that there is an issue except the table rows stop changing.
A full refresh of the dashboard is the only reliable way of forcing the correct number of rows to display. However, this is not a workable solution.

Does anyone know what has changed and if there is any workaround? Any ideas of how to get this input working reliably or an alternative that still enables users to choose how many rows to display in a table?

Tags (1)
0 Karma

gtedwards61
New Member

I am experiencing the same issue at 7.2.6, Once the count option is set once it will stay that way until next page load.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...