Splunk Search

What does the 10 do in the XML for my dashboard chart?

HattrickNZ
Motivator

Just looking through some of my old dashboards and came across the below chart in XML.
I was wondering what does 10 do?

<chart>
  <searchString>index=core ......... </searchString>
  <title>Att Users</title>
  <earliestTime>-1d@m</earliestTime>
  <latestTime>now</latestTime>
  <option name="charting.axisTitleX.text"/>
  <option name="charting.chart">line</option>
  <option name="charting.primaryAxisTitle.text"/>
  <option name="count">10</option>
  <option name="displayRowNumbers">true</option>
</chart>
Tags (3)
0 Karma
1 Solution

gyslainlatsa
Motivator

hi HattrickNZ,

for 10,
10 limits the number of results displayed per page to 10

View solution in original post

0 Karma

juvetm
Communicator

i am very sorry what there say above is error 10 is also a dafault number that indicate The maximum number of rows to display

0 Karma

stephanefotso
Motivator

I'm sorry, that property do not limit the number of results displayed per page. More explicitly, the property charting.data.count represent The number of results to retrieve from events. Set to 0, to get all results and default to 1000. You can decide to retrieve 1000 results from events, and display only 20 with limit, head, .... commands
For more informations concernin charting options, start here: http://docs.splunk.com/Documentation/Splunk/6.0.1/Viz/ChartConfigurationReference

SGF
0 Karma

gyslainlatsa
Motivator

hi HattrickNZ,

for 10,
10 limits the number of results displayed per page to 10

0 Karma

HattrickNZ
Motivator

tks but thats only if i have a stats table selected for the visualisation, but i have it currently set to a line so it probably has no affect? tks

0 Karma

gyslainlatsa
Motivator

I do not understand you very well

0 Karma

HattrickNZ
Motivator

i am basiacally saying that it is redundant as I have selected line as visualisation as opposed to stats table, not worries thanks. have you tried google transalate 🙂
tks again

0 Karma
Get Updates on the Splunk Community!

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...