Splunk Search

Can you help me with an issue with dashboard rows?

roopeshetty
Path Finder

Hi guys,

Is there any way we can display more than 100 rows in a table format dashboard? We tried to modify the below source settings, but it is not taking the value more than 100.

<option name="count">100</option>

Note : We are using Splunk Cloud instance, not on-premise.

Tags (2)
0 Karma

niketn
Legend

@roopeshetty Here is an option directly using Simple XML along with a run anywhere example which sets the number of rows as per the count of events in the search result which needs to be displayed in the table.

https://answers.splunk.com/answers/748334/removing-pagination-and-row-limit-displayed-in-a-t.html

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

woodcock
Esteemed Legend

First of all, open a support case on it. This used work but they broke it (probably deliberately) in the v7.* versions. It needs to come back. Until then, here is what we do:

 <row>
    <panel depends="$panel_show_datamodels_100$">
      <table>
        <title>Data Models included in $APP$ $datamodels_first_100$</title>
        <search>
          <query>|rest/servicesNS/-/$APP$/data/models splunk_server=local
| search eai:acl.app="*$APP$*"
| dedup id
| table eai:acl.app eai:acl.owner eai:acl.sharing disabled title acceleration acceleration.backfill_time eai:data
| rename eai:acl.* AS * eai:data AS defintion_JSON
| sort 0 title
| streamstats count AS _serial
| eventstats count AS _total
| search _serial<=100</query>
          <progress>
            <condition match="'job.resultCount' > 0">
              <eval token="datamodels_first_100">if(($result._total$<=100), "", "(first 100)")</eval>
              <set token="panel_show_datamodels_100">true</set>
            </condition>
            <condition>
              <unset token="panel_show_datamodels_100"></unset>
            </condition>
          </progress>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="rowNumbers">false</option>
        <option name="wrap">true</option>
        <drilldown target="_blank">
          <link>/manager/$env_app$/data_model_manager?app=$APP$&amp;app_only=1&amp;count=100&amp;nameFilter=$row.title$</link>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$panel_show_datamodels_200$">
      <table>
        <title>Data Models included in $APP$ (second 100)</title>
        <search>
          <query>|rest/servicesNS/-/$APP$/data/models splunk_server=local
| search eai:acl.app="*$APP$*"
| dedup id
| table eai:acl.app eai:acl.owner eai:acl.sharing disabled title acceleration acceleration.backfill_time eai:data
| rename eai:acl.* AS * eai:data AS defintion_JSON
| sort 0 title
| streamstats count AS _serial
| search _serial>100 AND _serial<=200</query>
          <progress>
            <condition match="'job.resultCount' > 0">
              <set token="panel_show_datamodels_200">true</set>
            </condition>
            <condition>
              <unset token="panel_show_datamodels_200"></unset>
            </condition>
          </progress>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="rowNumbers">false</option>
        <option name="wrap">true</option>
        <drilldown target="_blank">
          <link>/manager/$env_app$/data_model_manager?app=$APP$&amp;app_only=1&amp;count=100&amp;nameFilter=$row.title$</link>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
  <row>
    <panel depends="$panel_show_datamodels_300$">
      <table>
        <title>Data Models included in $APP$ (third 100)</title>
        <search>
          <query>|rest/servicesNS/-/$APP$/data/models splunk_server=local
| search eai:acl.app="*$APP$*"
| dedup id
| table eai:acl.app eai:acl.owner eai:acl.sharing disabled title acceleration acceleration.backfill_time eai:data
| rename eai:acl.* AS * eai:data AS defintion_JSON
| sort 0 title
| streamstats count AS _serial
| search _serial>200</query>
          <progress>
            <condition match="'job.resultCount' > 0">
              <set token="panel_show_datamodels_300">true</set>
            </condition>
            <condition>
              <unset token="panel_show_datamodels_300"></unset>
            </condition>
          </progress>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="rowNumbers">false</option>
        <option name="wrap">true</option>
        <drilldown target="_blank">
          <link>/manager/$env_app$/data_model_manager?app=$APP$&amp;app_only=1&amp;count=100&amp;nameFilter=$row.title$</link>
        </drilldown>
      </table>
    </panel>
  </row>
0 Karma

vnravikumar
Champion

Hi @roopeshetty

You can try using javascript. In the following javascript, I had mentioned 200 rows. Please let me know any issues

<dashboard script="table.js">
  <label>table</label>
  <row>
    <panel>
      <table id="tablesample">
        <search>
          <query>index=_internal |table bytes</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
         <option name="rowNumbers">true</option>
      </table>
    </panel>
  </row>
</dashboard>

javascript

 require([
     'underscore',
     'jquery',
     'splunkjs/mvc',
     'splunkjs/mvc/tableview',
     'splunkjs/mvc/simplexml/ready!'
 ], function(_, $, mvc, TableView) {
     var tablename = mvc.Components.get("tablesample");
         if(typeof(tablename)!="undefined") {
                 tablename.getVisualization(function(tableView) {
           tableView.settings.set("pageSize",200);
           });
             }
         }
);
0 Karma

roopeshetty
Path Finder

Hi Ravi,

we are using splunk on cloud, how can we ingest this java script on it?

0 Karma

vnravikumar
Champion
0 Karma

DMohn
Motivator

Hi @renjith.nair

No, you can't display mor than 100 rows, at least not without going into scripting your own JavaScript. Notice when you change the source code of your dashboard and enter a higher number than 100 it will show you something like

Warning on line xx: Value yyy is greater than the maximum 100

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...