Dashboards & Visualizations

How should I dynamically change the limit parameter in the head command

vaguiar
Engager

I have a search command which pipes to "| head limit=10". But I want to let the user decide if they see 10 or 20 or all the events returned.

One way that I could think of was by adding a drop-down with specific values such as 10, 20 and 999,999,999(very large number) and by passing that value as the limit of the head command. I wonder if there's a better way to do this though.

0 Karma
1 Solution

woodcock
Esteemed Legend

do a drop down and pass the entire command, not just the value, like this:

<input type="dropdown" token="count_filter">
  <label>Limit your Results</label>
  <choice value="">ALL (no filter)</choice>
  <choice value="| head 10">10</choice>
  <choice value="| head 20">20</choice>
  <default>All (no filter)</default>
</input>

Then the last line of your search should be $count_filter$ (without a leading pipe). This way you do not need that "huge number" aspect.

View solution in original post

woodcock
Esteemed Legend

do a drop down and pass the entire command, not just the value, like this:

<input type="dropdown" token="count_filter">
  <label>Limit your Results</label>
  <choice value="">ALL (no filter)</choice>
  <choice value="| head 10">10</choice>
  <choice value="| head 20">20</choice>
  <default>All (no filter)</default>
</input>

Then the last line of your search should be $count_filter$ (without a leading pipe). This way you do not need that "huge number" aspect.

vaguiar
Engager

Good point and it let's me select a default value as well. Thanks!

0 Karma

cmerriman
Super Champion

You could just use a text box with the header of "result count (enter whole number)" and use that token if you want them to get the number of results they desire.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...