Refine your search:

I am having an issue with some of the table options. I’d like to limit the table to 10 rows and then allow pagination. Here are my commands (simple xml):

 <option name="count">10</option>
 <option name="showPager">true</option>

While the pagination seems to be working, the count option doesn’t work at all – it defaults to displaying however many rows I had displayed in my saved search (ie, 50) and only does pagination after this point. Are my commands wrong, or is something else the problem? Any ideas?

asked 30 Jun '11, 14:07

egerner's gravatar image

egerner
21112
accept rate: 0%


3 Answers:

Emily, you're right. The count option has no effect. The showPager option does. See if this workaround works for you:

  1. in the flash timeline view, set 'Results per page' to 10
  2. save your search as a new search (this associates a new viewstate with the paginator count as 10)
  3. use the new saved search in your dashboard.

Alternatively, you (or your Splunk Admin) can correct the viewstate:

  1. find the viewstate id associated with the saved search in savedsearches.conf (e.g. vsid=gp902hc2)
  2. find the viewstate using the vsid in viewstates.conf.
  3. edit the Count_#_#_#.default, MaxLines_#_#_#.default, MaxLines_#_#_#.maxLines variables.
  4. restart Splunk.

This is a bug, which I will file on your behalf. Thank you for bringing this to our attention. :)

link

answered 01 Jul '11, 13:09

hulahoop's gravatar image

hulahoop ♦
2.6k141151
accept rate: 40%

What is your search that renders the table? I've never experienced this, but my searches tend to be something like "... | table field1, field2". Are you using the table command or something else?

link

answered 30 Jun '11, 16:54

mw's gravatar image

mw
1.7k215
accept rate: 29%

This is being tracked as SPL-32968. The problem is regarding applying viewstate. When a search is saved, a copy of the current view state is made and stored in $SPLUNK_HOME/etc/users/admin/search/local/viewstates.conf. When the search is loaded, the configuration that is last applied is the viewstate and this is clobbering the XML defined "count" option.

This is going to be fixed in 4.2.3, for anyone who is interested.

link

answered 22 Jul '11, 11:02

jbsplunk's gravatar image

jbsplunk ♦
10.6k1625
accept rate: 48%

Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×471
×156

Asked: 30 Jun '11, 14:07

Seen: 2,536 times

Last updated: 22 Jul '11, 11:02

Copyright © 2005-2012 Splunk Inc. All rights reserved.