I have tried adding the options to a dashboard, but after saving none of the options seems to have any effect:
The XML that is saved is:
<?xml version='1.0' encoding='utf-8'?>
<dashboard>
<!--
NOTE: This file was automatically generated by Splunk. Use caution when editing manually.
-->
<label>Backup View</label>
<row>
<event>
<searchName>Bacula Jobs in The Last 2 Days</searchName>
<title>Bacula Jobs</title>
<option name="count">5</option>
<option name="showPager">true</option>
<option name="displayRowNumbers">false</option>
</event>
</row>
</dashboard>
The Row numbers are still there, there are 10 items, and I don't see any pagination.
Reference:
http://www.splunk.com/base/Documentation/latest/Developer/PanelReference
Also, here is the output of the ?showsource=true
:
<view autoCancelInterval="90" isVisible="true" objectMode="SimpleDashboard" onunloadCancelJobs="true" refresh="-1" template="dashboard.html">
<label>Backup View</label>
<module name="AccountBar" layoutPanel="appHeader"/>
<module name="AppBar" layoutPanel="navigationHeader"/>
<module name="Message" layoutPanel="messaging">
<param name="filter">*</param>
<param name="clearOnJobDispatch">False</param>
<param name="maxSize">1</param>
</module>
<module name="Message" layoutPanel="messaging">
<param name="filter">splunk.search.job</param>
<param name="clearOnJobDispatch">True</param>
<param name="maxSize">1</param>
</module>
<module name="TitleBar" layoutPanel="viewHeader">
<param name="actionsMenuFilter">dashboard</param>
</module>
<module name="HiddenSavedSearch" layoutPanel="panel_row1_col1" group="Bacula Jobs" autoRun="True">
<param name="savedSearch">Bacula Jobs in The Last 2 Days</param>
<param name="groupLabel">Bacula Jobs</param>
<module name="ViewstateAdapter">
<param name="savedSearch">Bacula Jobs in The Last 2 Days</param>
<module name="HiddenFieldPicker">
<param name="strictMode">True</param>
<module name="JobProgressIndicator"/>
<module name="Paginator">
<param name="count">5</param>
<param name="entityName">results</param>
<module name="EventsViewer">
<param name="count">5</param>
<param name="displayRowNumbers">false</param>
</module>
</module>
</module>
</module>
</module>
</view>
Also, the log looks like it tells the paginator to use 10:
"GET /en-US/module/system/Splunk.Module.Paginator/render?length=10&count=10&max_pages=10&offset=0&client_app=search HTTP/1.1" 200 - "http://ny-man01.ny.stackoverflow.com:8000/en-US/app/search/backupdash2"
I had the same issue. It occurs because the "viewstate" of the saved search overrides the dashboard XML. This is the opposite of the behavior for charts, and in my opinion is a bug.
Workarounds:
It looks like there's a bug in the python that runs the simplified XML. If you have an <event>
node then it should be setting the entityName
param on the paginator to "events". Since it's setting it to "results" that's why it's not applying.
The only solution that springs to mind is to just convert to the Advanced XML. (and change that 'results' to 'events' of course)
And as for the displayRowNumbers param -- one thing I can think of is to try setting displayRowNumbers to "False" not "false". The module conf file declares that 'False' and 'True' are the only valid options. Once upon a time this was the convention across all the module params, in that all the boolean module keys were title-case (False/True). However over time people started adding options that were all lowercase so it became a little muddled.
What is the process for converting it to advanced xml?
Did you make the change to the file directly (as opposed to doing it through the Manager)? If so, did you re-start Splunk after doing so?
I made the option through the manager and restarted splunk. I just found the file itself and it does line up with what the manager shows.