topic Why is my $result.fieldname$ value isnt working? in Dashboards & Visualizations

Why is my $result.fieldname$ value isnt working?

patricianaguit — Mon, 23 Apr 2018 02:39:08 GMT

The token i set for "$result.sum$" isn't working when i call it in title. Is there something wrong with my code?

     <search>
                <query>index="ape_idx" sourcetype="ape_csv" "Account Group" != "Infrastructure Services"  
                  | eval week = strptime(Reporting_Week,"%m/%d/%Y")  
                  | sort -week limit=0  | dedup "Project Id" 
                  | fillnull value=NA  | lookup geo_region_new "Dominant Geographic Unit" as "Geographic Unit" outputnew "Geographic Region" 
                  | search "Geographic Region" = "AAPAC" | stats count as "Project Count" by "Geographic Region","Geographic Unit" 
                  | eventstats sum("Project Count") as Sum | fields - "Geographic Region","Geographic Unit", "Project Count" | dedup Sum
               </query>
                    <done>
                        <set token="aapacCount">$result.Sum$</set>
                     </done>
          <!---end of search for total count of aapac-->
            <title>Total Count: $aapacCount$</title>

Re: Why is my $result.fieldname$ value isnt working?

micahkemp — Mon, 23 Apr 2018 03:16:25 GMT

<title> isn't valid inside <search>, so it needs to be moved out. This run anywhere example shows what you're trying to accomplish, though:

<dashboard>
  <row>
    <panel>
      <title>$aapacCount$</title>
      <table>
        <search>
          <query>| tstats count WHERE index=* OR index=_*</query>
           <done>
              <set token="aapacCount">$result.count$</set>
            </done>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</dashboard>

Re: Why is my $result.fieldname$ value isnt working?

niketn — Mon, 23 Apr 2018 06:46:26 GMT

@patricianaguit have you ensured that your search is returning result/s? Also do you have earliest and latest time tokens passed to the search? It seems to be missing in the sample code. Just to be sure that $result.Sum$ picks a value even if underlying search returned no results you can try the following:

<query>
   <yourQueryGoesHere>
</query>
<earliest><yourEarliestTimeHere></earliest>
<latest><yourLatestTimeHere></latest>
<done>
      <condition match="$job.resultCount$==0">
            <set token="aapacCount">0</set>
      </condition>
      <condition match="$job.resultCount$==0">
            <set token="aapacCount">$result.Sum$</set>
      </condition>
</done>
<row>
        <panel>
               <title>$aapacCount$</title>
        </panel>
</row>

Second reason could be that query is taking too long to run. So you can try <progress> event handler instead of done.

Just a question are you on Splunk 6.5 or Higher?

Besides the points about the Token, you search query needs some tweaking:
1) I dont see a use of week field created, hence sort also.
2) dedup should be performed right after getting events from the base search.
3) stats should be done first then lookup then filter.
4) If you need the Sum field alone, perform stats which will just retain Sum field and not eventstats followed by removal of unwanted fields.