Dashboards & Visualizations

Chart HiddenSavedSearch not displaying all results

sonicZ
Contributor

Having an issue where our search on a dashboard with a certain view is not fully displaying all the results. I verified that many more results are returning when running the command line search string but something is wonky in our xml that is only displaying 11 results.
I've tried a few answer examples here to increase the results and height of the module but i still cant get over 11 results.

Our xml is as follows:

<view template="dashboard.html">
  <label>NOC Alert Dashboard</label>

  <module name="AccountBar" layoutPanel="appHeader">
    <param name="mode">lite</param>
  </module>

  <module name="TitleBar" layoutPanel="viewHeader">
    <param name="showActionsMenu">False</param>
  </module>

  <module name="HiddenSavedSearch" layoutPanel="panel_row1_col1" group="Six Hour Networking Critical Event Count" autoRun="True">
    <param name="savedSearch">Network Critical Event Counts</param>
    <param name="groupLabel">Six Hour Network Critical Event Count</param>
    <module name="JobProgressIndicator">
      <module name="HiddenChartFormatter">
        <param name="charting.chart.stackMode">stacked</param>
        <module name="FlashChart">
          <param name="width">100%</param>
          <param name="enableResize">False</param>
          <module name="ConvertToDrilldownSearch">
            <module name="ViewRedirector">
              <param name="viewTarget">flashtimeline</param>
            </module>
          </module>
        </module>
        <module name="ViewRedirectorLink">
          <param name="viewTarget">flashtimeline</param>
        </module>
      </module>
    </module>
  </module>

Search string is:
index=net | netcritical | search netcritical=true | timechart c by host | rename

Tags (3)
0 Karma
1 Solution

sonicZ
Contributor

Think i found the problem in other related answers, looks like i have to pass limit=0 to the timechart command like so

index=net earliest="-6h" | netcritical | search netcritical=true | timechart c by host limit=0 useother=f

View solution in original post

0 Karma

sonicZ
Contributor

Think i found the problem in other related answers, looks like i have to pass limit=0 to the timechart command like so

index=net earliest="-6h" | netcritical | search netcritical=true | timechart c by host limit=0 useother=f

0 Karma

MHibbin
Influencer

Are some of the results catergorised under "OTHER"? - have you tried including a "useother=f" in the timechart command.

Also, have you tried building a view with the actual search string (instead of the savedsearch).. I have some inexplicable issues with this sort of thing, and swapping out the savedsearch seems to help.

0 Karma

sonicZ
Contributor

I tried useother=f in the search and using the search string instead with no luck on limit going over 10

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...