Dashboards & Visualizations

How should I dynamically change the limit parameter in the head command

vaguiar
Engager

I have a search command which pipes to "| head limit=10". But I want to let the user decide if they see 10 or 20 or all the events returned.

One way that I could think of was by adding a drop-down with specific values such as 10, 20 and 999,999,999(very large number) and by passing that value as the limit of the head command. I wonder if there's a better way to do this though.

0 Karma
1 Solution

woodcock
Esteemed Legend

do a drop down and pass the entire command, not just the value, like this:

<input type="dropdown" token="count_filter">
  <label>Limit your Results</label>
  <choice value="">ALL (no filter)</choice>
  <choice value="| head 10">10</choice>
  <choice value="| head 20">20</choice>
  <default>All (no filter)</default>
</input>

Then the last line of your search should be $count_filter$ (without a leading pipe). This way you do not need that "huge number" aspect.

View solution in original post

woodcock
Esteemed Legend

do a drop down and pass the entire command, not just the value, like this:

<input type="dropdown" token="count_filter">
  <label>Limit your Results</label>
  <choice value="">ALL (no filter)</choice>
  <choice value="| head 10">10</choice>
  <choice value="| head 20">20</choice>
  <default>All (no filter)</default>
</input>

Then the last line of your search should be $count_filter$ (without a leading pipe). This way you do not need that "huge number" aspect.

vaguiar
Engager

Good point and it let's me select a default value as well. Thanks!

0 Karma

cmerriman
Super Champion

You could just use a text box with the header of "result count (enter whole number)" and use that token if you want them to get the number of results they desire.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...