Splunk Search

How to dynamically change the number of rows in a table - This was working using input token in 6.6.1, now is unreliable in 7.2

nzsci
New Member

I have been using inputs to allow users to select the number of rows in a table.

This has been working well, with no issues in Splunk 6.6.

An example of how I have been using code:

 <fieldset submitButton="false">
        <input type="dropdown" token="rowNo" searchWhenChanged="true">
          <label>No. of rows</label>
          <choice value="5">5</choice>
          <choice value="10">10</choice>
          <choice value="20">20</choice>
          <choice value="50">50</choice>
          <default>20</default>
        </input>
      </fieldset>
      <row>
        <panel>
          <table>
            <search>
              <query>index=tutorial | stats count by file method status</query>
              <earliest>0</earliest>
              <sampleRatio>1</sampleRatio>
            </search>
            <option name="count">$rowNo$</option>
            <option name="dataOverlayMode">none</option>
            <option name="drilldown">none</option>
            <option name="percentagesRow">false</option>
            <option name="rowNumbers">false</option>
            <option name="totalsRow">false</option>
            <option name="wrap">true</option>
            <option name="showPager">true</option>
          </table>
        </panel>
      </row>

Since upgrading to Splunk 7 this row change input is no longer reliable. It sometimes works and sometimes doesn't. Occasionally I will get an "Invalid count" error in the table, but generally there is no indication that there is an issue except the table rows stop changing.
A full refresh of the dashboard is the only reliable way of forcing the correct number of rows to display. However, this is not a workable solution.

Does anyone know what has changed and if there is any workaround? Any ideas of how to get this input working reliably or an alternative that still enables users to choose how many rows to display in a table?

Tags (1)
0 Karma

gtedwards61
New Member

I am experiencing the same issue at 7.2.6, Once the count option is set once it will stay that way until next page load.

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...