Reporting

Can't display more than 10 items after a search

Branden
Builder

I've seen this question floating around but I can't find a solution that works. I have a HiddenSearch that runs after you specify a date range. The problem is it will never return more than 10 items. I'd like to increase that number to, say, 100 (and if there's more than 100, give the user the option to click "Next" or something.)

I tried using "limit=100" in the search like someone suggested, but then it returns no results, which I understand. I also tried head, but then that produced an error.

Here's a snippet of code:

     <module name="TimeRangePicker">
        <param name="searchWhenChanged">True</param>
        <param name="selected">All time</param>
        <module name="HiddenSearch" group="Pick A Time" autoRun="True">
           <param name="search">| search host=xyz sourcetype="abc"</param>
           <module name="EventsViewer" layoutPanel="panel_row3_col1">
           </module>
        </module>

I'm guessing there's a simple solution to this. 🙂

Thanks!

Tags (1)
0 Karma
1 Solution

thall79
Communicator

Try adding the Paginator module.

 <module name="Paginator">
      <param name="count">10</param>
      <param name="entityName">results</param>
      <param name="maxPages">10</param>

Should look like this with your info:

  <module name="TimeRangePicker"> 
    <param name="searchWhenChanged">True</param>
    <param name="selected">All time</param>
    <module name="HiddenSearch" group="Pick A Time" autoRun="True" layoutPanel="panel_row3_col1">
       <param name="search">| search host=xyz sourcetype="abc"</param>                    

  <module name="Paginator">
      <param name="count">10</param>
      <param name="entityName">results</param>
      <param name="maxPages">10</param>


  <module name="EventsViewer" > 
     </module><!-- /EventsViewer-->
    </module><!-- /Paginator-->
   </module><!-- /HiddenSearch-->
  </module><!-- /TimeRangePicker-->

Here are 2 links for more information about the Paginator and its options:

http://www.splunk.com/base/Documentation/4.1.4/Developer/AdvancedSearch

http://www.splunk.com/base/Documentation/4.1.4/Developer/ModuleReference#Paginator

travis.

View solution in original post

thall79
Communicator

Try adding the Paginator module.

 <module name="Paginator">
      <param name="count">10</param>
      <param name="entityName">results</param>
      <param name="maxPages">10</param>

Should look like this with your info:

  <module name="TimeRangePicker"> 
    <param name="searchWhenChanged">True</param>
    <param name="selected">All time</param>
    <module name="HiddenSearch" group="Pick A Time" autoRun="True" layoutPanel="panel_row3_col1">
       <param name="search">| search host=xyz sourcetype="abc"</param>                    

  <module name="Paginator">
      <param name="count">10</param>
      <param name="entityName">results</param>
      <param name="maxPages">10</param>


  <module name="EventsViewer" > 
     </module><!-- /EventsViewer-->
    </module><!-- /Paginator-->
   </module><!-- /HiddenSearch-->
  </module><!-- /TimeRangePicker-->

Here are 2 links for more information about the Paginator and its options:

http://www.splunk.com/base/Documentation/4.1.4/Developer/AdvancedSearch

http://www.splunk.com/base/Documentation/4.1.4/Developer/ModuleReference#Paginator

travis.

Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...