Splunk Search

Simple XML view only shows 10 results in table

dang
Path Finder

I have a dashboard/view that is built using simple XML. There are tables on this view that are built from saved searches. The searches have the following code in them:

... | chart max(bytes) limit=20 by server

The table from the resulting search only shows 10 results. Changing the limit=0 does not change this, and using the search code (as opposed to a saved search) does not affect this either. If I run the search by itself, I can change the number of result per page, but that does not seem to be available using simple XML.

Is there something I can do, other than possibly rewrite the view using advanced XML that will allow this table to show more than 10 results?

Tags (2)
0 Karma

rafamss
Contributor

Drainy,

Is possible insert the value for this field using a variable ? Like this: $count$. Say this, because I have one dashboard that has a field like a joker.

Regards,

RM

0 Karma

Drainy
Champion

You can edit the simple XML and inside the

block add;

<option name="count">X number of rows</option>

Also, for more detail see here

Have a look here. Through simple XML you can define fields so you may not need to pipe to table at all, does it throw an error if you omit the table search command and just use a normal search inside the table xml as explained in that link?

dang
Path Finder

Thanks. I'll look into the fields enumeration.

0 Karma

Drainy
Champion

probably not. In fairness I am used to advanced XML. See my updated answer above

0 Karma

dang
Path Finder

Piping stats into table still doesn't increase the number of rows displayed in my view, but does seem to work in a regular search window. Is it possible this is a bug?

0 Karma

Drainy
Champion

oh you're using chart. change chart to stats and then pipe to table, e.g stats max(bytes) by server | table field,field2 limit=20 <- that might do it

0 Karma

dang
Path Finder

Thanks, Draineh. I've tried your recommended option, but I get the following error message when I refresh the view:
"The following options were specified but have no effect when a split-by clause is not provided:limit,"

We definitely have more than 10 servers that should be visible by this search. If you click the "view results" link, you can see there are 16 results, but unless you change the number of results per page (in that dropdown item), you get 10 at first. Any further recommendations?

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...