How to show more than 50 events on a page in 6.x?

[davidpaper]

Hi,

In the image above, the selections are 10, 20 and 50 events per page. In 5.x, the flashtimeline.xml is editable to be able to add more choices. That seems to have disappeared in the new search view in 6.x.

Anyone figure out how to add additional options to this pulldown? My users REALLY like being able to stuff 100, 500, 1000, or 5000 events on the screen at once.

Thanks!

[michealrp]

So, since version 3.x, at least as I recall, this has been asked time and time again. Yet, it's not a built in feature of the application. I'm curious why this isn't yet built in. 50 lines is quite a bit if you're on a mom and pop shop, however, in my environment, I'm using this for syslog entries as well as SIP traffic logging. Often, 50 lines isn't enough without cycling through the additional pages.

[kbarker302]

FWIW, there appears to be a way to do this, but it may not be recommended. Look in the following file:

C:\Program Files\Splunk\share\splunk\search_mrsparkle\exposed\js\build\searchpage.js

and look for the first occurrence of "10 per page". There you will see where the options for the dropdown are defined.

I was able to modify the existing values, and also added an option for 150 per page. After restarting Splunk, I saw my changes take effect.

However, please note a couple of things - this is a minified JavaScript file, so it would be really easy to break if you have a typo. Also, this would mean modifying what appears to be a core Splunk JavaScript file, which is probably not supported. But just for academic reasons, there is a way to modify this dropdown list if you really want to.

[davidpaper]

Thank you! I've been looking for a way to do this. Very sad that it's no longer officially supported via the flashtimeline.xml.

I found it (v6.3.1) by looking for this string: "this.model.report.entry.content,items" and replicating the ",{value:"10",label:_("10 Per Page").t()}" section with the new values I wanted to add at the end after the 50.

This is definitely going to get overwritten at upgrade time, and is not going to be officially supported by Splunk.

Thanks for posting this.

[myudkowsky]

Unfortunately, this fix no longer seems to work. My current savesearches.js now looks like this:

this.children.count = new s({
                    modelAttribute: "display.prefs.events.count",
                    model: this.model.content,
                    items: [{
                        value: "10",
                        label: _("10 Per Page").t()
                    }, {
                        value: "20",
                        label: _("20 Per Page").t()
                    }, {
                        value: "50",
                        label: _("50 Per Page").t()
                    }, {
                        value: "100",
                        label: _("100 Per Page").t()
                    }, {
                        value: "250",
                        label: _("250 Per Page").t()
                    }],
                    save: !4,
                    elastic: !0,
                    menuWidth: "narrow",
                    toggleClassName: "btn-pill",
                    popdownOptions: {
                        attachDialogTo: "body"
                    }
                })

However, the "250 Per Page" does not appear on the drop-down menu, and of course the default is not 250.'

Any ideas? I'll keep on searching, but so far no luck.

I'd also like to see the default of "All Time" in the search bar by something more reasonable, such as 24 hours. Any ideas on how to find and modify it?

[davidpaper]

Check into modifying times.conf to change the default.

No idea on why the hack above no longer works. What version are you running that it stopped working?

[myudkowsky]

I apologize - I failed to check in advance. I'm using

VERSION=6.2.1
BUILD=245427
PRODUCT=splunk
PLATFORM=Linux-x86_64

Is it possible the same exact text does not work in 6.2.x, but does in 6.3.x? This file is "clearly" the file, as its original settings of count=20 as the default ("save: !1") are still in place. I wonder if I have to quit the browser and/or flush the cache...

I will look into times.conf; so far I can't see how to set the default.

[myudkowsky]

And there you have it: had to flush the browser cache. "50" comes up as default instead of "250" lines per page, but at least it's feasible. Questions are now:

1. What is the correct way to create a new default for number of lines per page?
2. Where is the setting for default time range for searches? "All Time" is not helpful, and in fact quite an odd choice.

[davidpaper]

1) Not sure. I never figured out how to change the default.

2) Oops, I was wrong. it's ui-prefs.conf.

Create a file: $SPLUNK_HOME/etc/apps/search/local/ui-prefs.conf
Create a search stanza like this:

[search]
dispatch.earliest_time = -7d@d
dispatch.latest_time = now

Restart Splunk and you're good to go!

[myudkowsky]

Excellent, thank you.

FYI I had to create a copy of this in a separate app - that is, in
etc/apps/prophecy-premise/local/
because my setup has that app, with specialized searches, built-in by the provider. And "of course" I flushed the browser cache.

I'll continue to pursue setting the default for the number of rows per page. I'm guessing that it's possible to set it.

[myudkowsky]

Update: adding

display.prefs.events.count = 250

to the ui-prefs.conf stanza did not work.

[myudkowsky]

As of September 2017, working on a new installation, I have still not found a way to modify the current searches to use 250 lines by default.

[myudkowsky]

P.S. I have un-minified the JS using a tool in order to avoid any errors in my edits.

[aferone]

I am interested in this answer as well. The old posts don't seem to apply to 6.X, especially the flashtimeline stuff.

[calbree]

Anyone have any suggestions? This would be useful for us as well.

[aferone]

I opened a case with Splunk, and they told me it wasn't possible to make changes to increase the rows in 6.X, which I find baffling.

[jkat54]

I gave it hackery hell and lost the battle ;-(