showPager and count values not being respected

[joshd]

Hello,

I've created a custom dashboard with specific count and showPager option values for each table on the dashboard. However when I load the dashboard they do not seem to be respected. If I set the count to 10 and showpager to true, I'll still get 42 results in the table.

My only thought is that for my user when I search I have set the return value of 50 results per page. Could this be carrying over onto the dashboard? If so, how would you override it?

Thanks.

[sideview · Accepted solution]

No, that 50 wont carry over from the search view's preferences over into the dashboard.

Could you paste in the simplified XML that you're using?

For what it's worth I just copied some XML from search_status.xml in the search app and tried out showPager and count and they seem to work as expected. See below.

<row>
    <table>
      <title>Recent searches by expense (last hour)</title>
      <searchString>`audit_searchlocal` |  convert num(total_run_time) | eval user = if(user="n/a", null(), user) | `audit_rexsearch` | eval is_scheduled = if(search_id LIKE "scheduler%", "yes", "no") | stats min(_time) as _time first(user) as user first(total_run_time) as total_run_time first(search) as search first(is_scheduled) as is_scheduled by search_id | search user=* | sort - total_run_time</searchString> 
      <earliestTime>-1h</earliestTime>
      <fields>_time,user,is_scheduled,total_run_time,search</fields>
      <option name="showPager">true</option>
      <option name="count">5</option>
    </table>
  </row>

[joshd]

Ok, thanks for your help. I haven't had much experience with the Advanced XML yet...where might I find some good reading on this?

[sideview]

It definitely sounds like a bug. I would email support@splunk that you've found a bug in the simplified XML. In the meantime I would convert your view to the Advanced XML and whatever it is you wont suffer the problem there.

[joshd]

Yup it looks like that works now.

So I guess it has to do with something carrying over from the saved search?

[sideview]

Hmm. If you manually copy the search out of the saved search and replace it in as 'searchString', does it work then?

[joshd]

Hey nick, thanks for your reply. Could it be that since I'm using a saved search this is why Im getting the 50 results?

Here is a sample of my XML:

<table>
<searchName>INTERNAL - FAS Func Avg Exec Times Last 24hrs</searchName>
<title>FAS Web App - Avg Function Exec Times (Last 24hrs)</title>
<option name="count">10</option>
<option name="displayRowNumbers">true</option>
<option name="drilldown">none</option>
<option name="showPager">true</option>
</table>