Add a table

Add a table

The table panel displays search results in a sortable table. It's particularly useful if you have a set of results that you'd like to display in order. For example, use a table if you want to see a list of the top IP addresses that have accessed your web application in the last 24 hours. Any fields you want to display in your table should be explicitly added to your search.

Configure the table panel

The following basic example shows how to add a table to the dashboard you've been building. Use the <table> tag to add a table.

<dashboard>
 <label>My dashboard</label>
  <row>
   <table>
    <title>Top users by IP</title>
    <searchName>Top users by IP</searchName>
   </table>
  </row>
</dashboard>

This example references a saved search called Top users by IP. The saved search should include chart formatting to appear correctly as a chart. Also, make sure this saved search is shared with all users and roles who access this dashboard. Any saved search referenced in searchName must exist in savedsearches.conf in the app's default or local directory or be set as global.

The <title> tag displays a title above the table. You can add a title to any panel in a dashboard. There are other options available for all panels. See Step 3 : add panels for more information.

Specify an inline search

If you want to create a one-off search for your dashboard, you can add it inline to the XML with the <searchString> tag. Note that this method runs your search every time your dashboard is loaded. If you have a long running search or a lot of users accessing this dashboard, using an inline search may create a high load on your Splunk system.

<dashboard>
 <label>My dashboard</label>
  <row>
   <table>
    <title>Top users</title>
    <searchString>host=production | top users</searchString>
   </table>
  </row>
</dashboard>

Configure table specific options

You can set other configuration options that are only available for table panels, such as the count of rows to display, whether or not you display row numbers and whether or not you allow pagination on the table. For example, this snippet limits the count of rows to 25 and displays row numbers:

<table>
    <title>Look here for errors that you need to care about</title>
    <searchName>Errors in the last 24 hours</searchName>
    <fields>host, source, errorNumber</fields>
    <option name="count">25</option>
    <option name="displayRowNumbers">true</option>
</table>

Here's a list of table specific options:

count = integer

• The maximum number of rows to display.

displayRowNumbers = true | false

• Toggle display of row numbers to the left of results.

showPager = true | false

• Show paging in the table.

• Was this topic useful?
• Post a comment