Splunk Search

Saved Search in Splunk 5 produces a table, but in Splunk 6 a column chart and table. Why?

twinspop
Influencer

The search is nothing special. It ends with a stats command showing avg, median, p95 and max values. In Splunk 5, where I crafted and saved the search initially, it results in a table. That's what I wanted. In Splunk 6, it shows a column chart on the top of the page, with the table underneath. With so many entries in the table, the column chart is useless.

There aren't any options for controlling this behavior in the saved search edit page. Nor any widgets to hide the graph on the results page.

How do I make the saved search return only the table?

The saved search is:

 index=iislog | eval uri=upper(uri) | rex field=referer "(?i)https?://(?<refhost>[^:/]+)"| stats count p95(rtt) as p95 by dc refhost version | where count>1000 | stats list(dc) as DC list(version) as Version list(count) as Pageviews list(p95) as "95th% RTT" by refhost

What it looks like in Splunk 6

EDIT: All of my saved searches are doing this. Any saved search that results in a table is now resulting in a graph and a table. Bah, I really don't want to create views for each of these. Is there anyway to turn off this behavior?

1 Solution

Simon_Fishel
Splunk Employee
Splunk Employee
  • from the page where you're viewing the report, select Edit -> Open In Search
  • once you land in Search, click Save (if it's greyed out you may have to make a meaningless change)
  • in the dialog that comes up, select "None" for "Visualization" and save it

View solution in original post

Simon_Fishel
Splunk Employee
Splunk Employee
  • from the page where you're viewing the report, select Edit -> Open In Search
  • once you land in Search, click Save (if it's greyed out you may have to make a meaningless change)
  • in the dialog that comes up, select "None" for "Visualization" and save it

coleman07
Path Finder

Is there a solution to this problem so we don't have to do this?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try adding '| table DC, Version, Pageviews, "95th% RTT"' to the end of your search.

---
If this reply helps you, Karma would be appreciated.

twinspop
Influencer

It seemed to work... when clicking run from the Management page it did. But when I select the saved search from the menu i still get the graph. Bugga. Thanks for trying.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...