Splunk Search

How to dynamically change the number of rows in a table - This was working using input token in 6.6.1, now is unreliable in 7.2

nzsci
New Member

I have been using inputs to allow users to select the number of rows in a table.

This has been working well, with no issues in Splunk 6.6.

An example of how I have been using code:

 <fieldset submitButton="false">
        <input type="dropdown" token="rowNo" searchWhenChanged="true">
          <label>No. of rows</label>
          <choice value="5">5</choice>
          <choice value="10">10</choice>
          <choice value="20">20</choice>
          <choice value="50">50</choice>
          <default>20</default>
        </input>
      </fieldset>
      <row>
        <panel>
          <table>
            <search>
              <query>index=tutorial | stats count by file method status</query>
              <earliest>0</earliest>
              <sampleRatio>1</sampleRatio>
            </search>
            <option name="count">$rowNo$</option>
            <option name="dataOverlayMode">none</option>
            <option name="drilldown">none</option>
            <option name="percentagesRow">false</option>
            <option name="rowNumbers">false</option>
            <option name="totalsRow">false</option>
            <option name="wrap">true</option>
            <option name="showPager">true</option>
          </table>
        </panel>
      </row>

Since upgrading to Splunk 7 this row change input is no longer reliable. It sometimes works and sometimes doesn't. Occasionally I will get an "Invalid count" error in the table, but generally there is no indication that there is an issue except the table rows stop changing.
A full refresh of the dashboard is the only reliable way of forcing the correct number of rows to display. However, this is not a workable solution.

Does anyone know what has changed and if there is any workaround? Any ideas of how to get this input working reliably or an alternative that still enables users to choose how many rows to display in a table?

Tags (1)
0 Karma

gtedwards61
New Member

I am experiencing the same issue at 7.2.6, Once the count option is set once it will stay that way until next page load.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...