How to expand "Results per Page" dropdown? WITH ANSWER!

Question

This is both a question AND an answer.

I want to see more than 50 lines of output on a results page? How do I do that?

Being restricted to 10, 20 or 50 events worth of output stinks. Badly. Splunk doesn't provide a mechanism to do this, but it is changeable if you are adventurous.

In $SPLUNK/share/splunk/search_mrsparkle/modules/results/page_controls/Count.html (back this file up first), add the following for 100 events under the "% endfor" at or near line 42:

    <option value="100">100</option>

This will leave the 10, 20, and 50 with 50 being the default, but give you the option of 100. Reloading the search app will pick up the change, no need to restart Splunkweb.

Enjoy.

Accepted Answer

3

In $SPLUNK/share/splunk/search_mrsparkle/modules/results/page_controls/Count.html (back this file up first), add the following for 100 events under the "% endfor" at or near line 42:

<option value="100">100</option>

This will leave the 10, 20, and 50 with 50 being the default, but give you the option of 100. Reloading the search app will pick up the change, no need to restart Splunkweb.

Enjoy.

EDIT Drat.

So it turns out this only works on 4.1.x. When I upgrades to 4.2.[34], this hack breaks. TOTAL SUCK! Will re-post as soon as I figure out how to get this trick to work in 4.2.x.

link

answered 07 Jul '11, 12:12

dpaper
196●1●9
accept rate: 50%

edited 01 Nov '11, 17:31

1

Absolutely awesome!! Tremendous!

(27 Jul '11, 16:27) jaxjohnny

this should be the default. Adding 100,200 and 500

(01 Nov '11, 14:57) MBerikcurtis

Answer 2

You want to edit the XML to accomplish this. Dont go editing the module source code as dpaper suggested, because for one thing such changes are guaranteed to break on upgrades.

So if you want to alter the default 'flashtimeline' view, you would log in as admin, go to Manager, User Interface, Views, Then find 'flashtimeline' and click it to edit. In the massive block of XML (you may want to temporarily paste it out into a text editor), find the block that looks like this

<module name="Count" layoutPanel="pageControls">
  <param name="options">
    <list>
      <param name="text">10</param>
      <param name="value">10</param>
    </list>
    <list>
      <param name="text">20</param>
      <param name="value">20</param>
    </list>
    <list>
      <param name="text">50</param>
      <param name="selected">True</param>
      <param name="value">50</param>
    </list>
  </param>

As you can see the options that are presented by the Count module are actually configured explicitly in the view. Apps often stick with these same options = 10,20,50. But nothing prevents you from pasting in another <list> block with appropriate <param> tags and you can get 100,200,500 etc...

Note: If you're the really adventurous sort, Sideview Utils now includes an "Events" module that is similar to EventsViewer except that it implements an endless scrolling system. When the user scrolls down or up, it will fetch more events as necessary. As such you can dispense with both the Pager module (or Paginator if you still use Paginator) and the Count module. Sideview Utils contains an implemented example of the flashtimeline view with this functionality already in there. Check it out. Also it's quite new so let me know if you have any problems or feedback.

Answer 3

0	This works in version 5.x also. link answered 20 Mar, 04:42 jaxjohnny 11 accept rate: 0%

How to expand "Results per Page" dropdown? WITH ANSWER!

Follow this question

Splunk Resources

Related questions