Dashboards & Visualizations

Chart HiddenSavedSearch not displaying all results

sonicZ
Contributor

Having an issue where our search on a dashboard with a certain view is not fully displaying all the results. I verified that many more results are returning when running the command line search string but something is wonky in our xml that is only displaying 11 results.
I've tried a few answer examples here to increase the results and height of the module but i still cant get over 11 results.

Our xml is as follows:

<view template="dashboard.html">
  <label>NOC Alert Dashboard</label>

  <module name="AccountBar" layoutPanel="appHeader">
    <param name="mode">lite</param>
  </module>

  <module name="TitleBar" layoutPanel="viewHeader">
    <param name="showActionsMenu">False</param>
  </module>

  <module name="HiddenSavedSearch" layoutPanel="panel_row1_col1" group="Six Hour Networking Critical Event Count" autoRun="True">
    <param name="savedSearch">Network Critical Event Counts</param>
    <param name="groupLabel">Six Hour Network Critical Event Count</param>
    <module name="JobProgressIndicator">
      <module name="HiddenChartFormatter">
        <param name="charting.chart.stackMode">stacked</param>
        <module name="FlashChart">
          <param name="width">100%</param>
          <param name="enableResize">False</param>
          <module name="ConvertToDrilldownSearch">
            <module name="ViewRedirector">
              <param name="viewTarget">flashtimeline</param>
            </module>
          </module>
        </module>
        <module name="ViewRedirectorLink">
          <param name="viewTarget">flashtimeline</param>
        </module>
      </module>
    </module>
  </module>

Search string is:
index=net | netcritical | search netcritical=true | timechart c by host | rename

Tags (3)
0 Karma
1 Solution

sonicZ
Contributor

Think i found the problem in other related answers, looks like i have to pass limit=0 to the timechart command like so

index=net earliest="-6h" | netcritical | search netcritical=true | timechart c by host limit=0 useother=f

View solution in original post

0 Karma

sonicZ
Contributor

Think i found the problem in other related answers, looks like i have to pass limit=0 to the timechart command like so

index=net earliest="-6h" | netcritical | search netcritical=true | timechart c by host limit=0 useother=f

0 Karma

MHibbin
Influencer

Are some of the results catergorised under "OTHER"? - have you tried including a "useother=f" in the timechart command.

Also, have you tried building a view with the actual search string (instead of the savedsearch).. I have some inexplicable issues with this sort of thing, and swapping out the savedsearch seems to help.

0 Karma

sonicZ
Contributor

I tried useother=f in the search and using the search string instead with no luck on limit going over 10

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...