Splunk Search

How to display a table that shows all rows without pagination?

marxsabandana
Path Finder

I need to display a table that will show all the rows without pagination. I have already tried using "showPager" option in XML but it just removed the pagination and still displays 100 rows only. Is there a way to set the row count to unlimited?

0 Karma

niketn
Legend

[UPDATED Code works in 7.2.6 but not on 7.3.0]

Just found out that while this worked in 7.2.6, it does not work in 7.3.0. Something is broken because it does not work in intended way anymore. So, Simple XML JS extension will be required to read the $job.resultCount$ token and render table with same number of rows and hence remove pagination.


@marxsabandana try the following run anywhere dashboard example using Simple XML which gets the result count from the search result using default search token $job.resultCount$ that needs to be populated in the table,

 <done>
   <set token="tokRowsPerPage">$job.resultCount$</set>
 </done>

Then passes the count to the table option:

<option name="count">$tokRowsPerPage$</option>`

PS:
1) Post processing using search id srchForTbl has been used to get the result count from search and then add the dependency of token tokRowsPerPage to the table so that the table renders only after the token is set.
2) I have used | fields - $tokRowsPerPage$ for adding token dependency to the table search however, you can use comment macro instead.
3) If you know an upper limit of table with all the records you can set the same using <init> section to set the token in the dashboard and step 1 with post processing will not be required.
4) This would work on Splunk 6.5 or higher.
Following is the complete Simple XML code for the run anywhere example.

 <form>
  <label>Table Pagination</label>
  <search id="srchForTbl">
    <query>index=_internal sourcetype=splunkd log_level!=INFO
| timechart span=5m count by component limit=5 useother=f
| streamstats count as sno
| fields sno *</query>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
    <sampleRatio>1</sampleRatio>
    <done>
      <set token="tokRowsPerPage">$job.resultCount$</set>
    </done>
  </search>
  <fieldset submitButton="false"></fieldset>
  <row>
    <panel>
      <input type="text" token="testTextBox" searchWhenChanged="true">
        <label>(Testing) Rows per page based on Search Result</label>
        <default>$tokRowsPerPage$</default>
      </input>
      <table>
        <search base="srchForTbl">
          <query>| fields - $tokRowsPerPage$</query>
        </search>
        <option name="count">$tokRowsPerPage$</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

Please try out and confirm!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

vnravikumar
Champion
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...