I am having an issue with some of the table options. I’d like to limit the table to 10 rows and then allow pagination. Here are my commands (simple xml):
While the pagination seems to be working, the count option doesn’t work at all – it defaults to displaying however many rows I had displayed in my saved search (ie, 50) and only does pagination after this point. Are my commands wrong, or is something else the problem? Any ideas?
asked 30 Jun '11, 14:07
Emily, you're right. The count option has no effect. The showPager option does. See if this workaround works for you:
Alternatively, you (or your Splunk Admin) can correct the viewstate:
This is a bug, which I will file on your behalf. Thank you for bringing this to our attention. :)
answered 01 Jul '11, 13:09
What is your search that renders the table? I've never experienced this, but my searches tend to be something like "... | table field1, field2". Are you using the table command or something else?
answered 30 Jun '11, 16:54
This is being tracked as SPL-32968. The problem is regarding applying viewstate. When a search is saved, a copy of the current view state is made and stored in $SPLUNK_HOME/etc/users/admin/search/local/viewstates.conf. When the search is loaded, the configuration that is last applied is the viewstate and this is clobbering the XML defined "count" option.
This is going to be fixed in 4.2.3, for anyone who is interested.
answered 22 Jul '11, 11:02