First I apologize for having any "attitude" around this. From the little I have read, this is a problem that has been around for at least 3 years. And from what I have read, the Splunk techs have not repaired. If I am mistaken and they have, please advise. Otherwise, read on. The solutions I have read about clicking the search instead and exporting from there is not REALLY a solution. The reason for using a base search, at least from my POV, is to speed up the displaying of data on a dashboard with multiple panels. Having to open a separate search tab for each panel defeats the purpose of using a base search because each 5, 10, 15, 20 min+ search has to run all over again. The other workaround of using saved searches and loads likewise defeats the purpose of using a base search. Splunk should stop offering "workarounds" and fix the issue. In the meantime, I have come up with a "work-around" that I now unfortunately have to implement. Add the following text input and option to your dashboard code. <fieldset submitButton="false" autoRun="false">
<input type="text" token="tok_rowsPerTable" searchWhenChanged="true">
<label>Rows per Table>
<default>10</default>
</input>
</fieldset>
<option name="count">$tok_rowsPerTable$</option> Note: You can add the input to each panel, just before the <table> tag. Remember to remove the <fieldset> and </fieldset> tags first. You will click and drag the table cells and then copy and paste them into an Excel file. I know this is a drag, pun intended, but it is the only efficient workaround I have found to reduce the time it would take to open a search for each of my 20 panels. And if any customers are developers, please create a permanent code fix that the Splunk techs can implement. And if they won't implement it, at least the Splunk community can use it. Again, if this has already been resolved and I missed it somewhere, please advise. Thanks and God bless, Genesius
... View more