Fork this blog on GitHub Fork this blog on GitHub

Splunk – Customize the “Results per page” Dropdown

Splunk – Customize the “Results per page” Dropdown

Do you want to customize Splunk by:

  • Extending the default choices of 10, 20 and 50 results per page?
  • Changing the default number of search results?

This quick how to describes how to implement both of these changes.

Start by making a custom local copy of configuration file that we are about to change:

cp –p $SPLUNK_HOME/etc/apps/$APPNAME/default/data/ui/views/flashtimeline.xml \ 

$APPNAME is your app or search for the default search app

Extend the XML Count options with some extra XML like so:

<module name="Count" layoutPanel="pageControls"> 
<param name="options"> 
<param name="text">10</param> 
<param name="value">10</param> 
<param name="text">20</param> 
<param name="value">20</param> 
<param name="text">50</param> 
<param name="selected">True</param> 
<param name="value">50</param> 

<param name="text">100</param> 
<param name="value">100</param> 
<param name="text">500</param> 
<param name="value">500</param> 
<param name="text">1000</param> 
<param name="value">1000</param> 


The extra <list> elements in the example add the new result count options. The 'selected' parameter changes the default count option to be 50 results.

Let me know if this is useful or if you have any questions!

Next entry

Previous entry

Similar entries


No comments yet.

Post your comment


Pingbacks are closed.