topic Count searches with results in Dashboards & Visualizations

Count searches with results

Coffeebean — Wed, 21 Jul 2021 15:02:23 GMT

Hey there,
I just started with splunk. Currently I'm testing the new dashboard studio feature.
I would like to count all searches with 1 or more found events on my dashboard.
In case of the attached picture, I would like to display 3 in the upper SingleValue field. If the search for Event 2 has 0 results, i would like to display a 2, and so on.

Is there a simple and scalable solution to this, if I want to add more searches to the dashboard later on?

Thank you in advance!

Re: Count searches with results

jhanvidattani — Wed, 28 Jul 2021 13:01:41 GMT

@Coffeebean

Can you try the below solution?

<form> <init><set token="total_count">0</set></init> <search id="base"> <query>index="_internal" | dedup host, source, sourcetype | table host, source, sourcetype</query> <earliest>$time_token.earliest$</earliest> <latest>$time_token.latest$</latest> </search> <label>Test Dashboard</label> <fieldset submitButton="false"> <input type="time" token="time_token" searchWhenChanged="true"> <label>Time Range</label> <default> <earliest>-4h@h</earliest> <latest>now</latest> </default> </input> </fieldset> <row depends="$never_show_this_panel$"> <panel> <table> <title>Table</title> <search base="base"> <query>| table source, sourcetype, host</query> <done> <condition match="isnotnull($result.source$) AND isnotnull($result.sourcetype$) AND isnotnull($result.host$)"> <set token="total_count">3</set> </condition> <condition match="(isnotnull($result.source$) AND isnotnull($result.sourcetype$)) OR (isnotnull($result.source$) AND isnotnull($result.host$)) OR (isnotnull($result.sourcetype$) AND isnotnull($result.host$))"> <set token="total_count">2</set> </condition> <condition match="isnotnull($result.source$) OR isnotnull($result.sourcetype$) OR isnotnull($result.host$)"> <set token="total_count">1</set> </condition> </done> </search> <option name="drilldown">none</option> </table> </panel> </row> <row> <panel> <single> <title>Panels Populated</title> <search> <query>| makeresults | eval total=$total_count$ </query> </search> <option name="drilldown">none</option> </single> </panel> </row> <row> <panel> <single> <title>Host</title> <search base="base"> <query>| stats dc(host)</query> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </single> </panel> <panel> <single> <title>Source Type</title> <search base="base"> <query>| stats dc(sourcetype)</query> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </single> </panel> <panel> <single> <title>Source</title> <search base="base"> <query>| stats dc(source)</query> </search> <option name="drilldown">none</option> </single> </panel> </row> </form>

If you find a solution fruitful, then an upvote and acceptance of the answer would be appreciated.

Re: Count searches with results

Coffeebean — Wed, 28 Jul 2021 15:20:11 GMT

@jhanvidattani
Thanks for the answer, but that looks like a XML solution.
As i tried this method with Dashboard Studio, which doesn't support XML, this will probably not work.

I will try to redesign my project with the old Dashboard builder.

Re: Count searches with results

MMahlberg — Tue, 03 Aug 2021 09:14:54 GMT

Sure, it can be done but you have to do it in one query and then select the fields in the field selector. Try this:

{

"visualizations": {

"viz_L1aSlLpB": {

"type": "splunk.singlevalue",

"dataSources": {

"primary": "ds_HbMCf42K"

"title": "field1"

"viz_gpsfTDga": {

"type": "splunk.singlevalue",

"options": {

"majorValue": "> sparklineValues | lastPoint()",

"trendValue": "> sparklineValues | delta(-2)",

"sparklineValues": "> primary | seriesByName('field3')"

"dataSources": {

"primary": "ds_HOFmRc1r_ds_HbMCf42K"

"title": "field3"

"viz_gAmWIokL": {

"type": "splunk.singlevalue",

"options": {

"majorValue": "> sparklineValues | lastPoint()",

"trendValue": "> sparklineValues | delta(-2)",

"sparklineValues": "> primary | seriesByName('field2')"

"dataSources": {

"primary": "ds_Epg28xu5_ds_HOFmRc1r_ds_HbMCf42K"

"title": "field2"

"viz_3gzCc3Pv": {

"type": "splunk.singlevalue",

"options": {

"majorValue": "> sparklineValues | lastPoint()",

"trendValue": "> sparklineValues | delta(-2)",

"sparklineValues": "> primary | seriesByName('Total')"

"dataSources": {

"primary": "ds_WVxE4sTM_ds_HOFmRc1r_ds_HbMCf42K"

"title": "total"

}

"dataSources": {

"ds_HbMCf42K": {

"type": "ds.search",

"options": {

"name": "Search_1"

"ds_HOFmRc1r_ds_HbMCf42K": {

"type": "ds.search",

"options": {

"name": "Copy of Search_1"

"ds_Epg28xu5_ds_HOFmRc1r_ds_HbMCf42K": {

"type": "ds.search",

"options": {

"name": "Copy of Copy of Search_1"

"ds_WVxE4sTM_ds_HOFmRc1r_ds_HbMCf42K": {

"type": "ds.search",

"options": {

"name": "Copy of Copy of Search_1"

"ds_6sMlf8EL_ds_Epg28xu5_ds_HOFmRc1r_ds_HbMCf42K": {

"type": "ds.search",

"options": {

"name": "Copy of Copy of Copy of Search_1"

}

"defaults": {

"dataSources": {

"ds.search": {

"options": {

"queryParameters": {

"latest": "$global_time.latest$",

"earliest": "$global_time.earliest$"

}

"inputs": {

"input_global_trp": {

"type": "input.timerange",

"options": {

"token": "global_time",

"defaultValue": "-24h@h,now"

"title": "Globale Zeitspanne"

}

"layout": {

"type": "absolute",

"options": {

"display": "auto-scale"

"structure": [

{

"item": "viz_L1aSlLpB",

"type": "block",

"position": {

"x": 120,

"y": 160,

"w": 200,

"h": 130

}

{

"item": "viz_gpsfTDga",

"type": "block",

"position": {

"x": 550,

"y": 160,

"w": 200,

"h": 130

}

{

"item": "viz_gAmWIokL",

"type": "block",

"position": {

"x": 340,

"y": 160,

"w": 200,

"h": 130

}

{

"item": "viz_3gzCc3Pv",

"type": "block",

"position": {

"x": 340,

"y": 10,

"w": 200,

"h": 130

}

"globalInputs": [

"input_global_trp"

]

"description": "",

"title": "test"

}