topic Re: Get the number of events returned in a csv through a text input in Dashboards & Visualizations

Get the number of events returned in a csv through a text input

learningsplunk — Tue, 21 Jul 2020 05:54:01 GMT

example file : Stocks.csv

Stock ticker	Stock price
IBM	120
NFLX	240
APPL	999

And in the dashboard it will show:

Number of stocks selected by input

User has a text input where they can put a search term that will search both columns at once. ( The token for the search query is $Stocks$)

If the user puts in say "L"

This is what will return :

Stock ticker	Stock price
NFLX	240
APPL	999

And in the dashboard it will show:

Number of stocks selected by input

I've tried this query :

|inputlookup Stocks.csv |stats count as Total ( which only gets the total number of stocks back in the csv file.... NOT the actual number of stocks selected by the user from their text input......)

However is there any way possible to get the " Number of stocks selected by input" correctly ?

Re: Get the number of events returned in a csv through a text input

niketn — Tue, 21 Jul 2020 11:43:54 GMT

@learningsplunk try the following, where token from the text box is $Stocks$

| inputlookup Stocks.csv where Stock_ticker="*$Stocks$*" | stats count

Re: Get the number of events returned in a csv through a text input

learningsplunk — Tue, 21 Jul 2020 14:43:44 GMT

Well then, looks like it works,! Wasn't aware that you could use the token to actually pass said value(s) in that statement.

Re: Get the number of events returned in a csv through a text input

niketn — Tue, 21 Jul 2020 15:20:49 GMT

@learningsplunk this would be a good Doc page to start reading about Tokens in Dashboards: https://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens

Re: Get the number of events returned in a csv through a text input

learningsplunk — Tue, 21 Jul 2020 16:49:51 GMT

One other question to add to this ,if there were multiple columns, for example :

Stock Ticker	Stock price	Company Name	Address	Owner
IBM	120	IBM	1 Main Street	Neera
NFLX	240	Netflix	23 Exchange Blvd	Jill
EE	360	Eric's Electric	999 Ways And Means	Eric
Spl	480	Splunk	10 Joseph Street	Paul

And the user typed in "ee"

and the return value is always 0..... is there a way to return the number of rows 3, instead of returning an incorrect value of 0 or returning an incorrect value of 4 ?