How do you show a row count in a dashboard panel?

edwardrose — Tue, 02 Oct 2018 19:28:54 GMT

Hello All

I am not sure how to show the row count in my dashboard.

I have one panel that searches a list of hosts for data and displays the indexes and source types. I have a second panel that shows hosts that are not reporting into Splunk and I would like to have the count listed at the top of the panel.

I did try to follow some instructions from others on answers.splunk.com, but the XML keeps giving me errors. Can someone please help me get it right?

thanks
ed

<form>
  <label>DMZ Host Data</label>
  <description>List of all DMZ Hosts and the data collected</description>
  <fieldset autoRun="false">
    <input type="dropdown" token="hostname">
      <label>Host Name</label>
      <fieldForLabel>hostname</fieldForLabel>
      <fieldForValue>hostname</fieldForValue>
      <search>
        <query>| inputlookup dmzhosts.csv 
| dedup hostname 
| search NOT hostname=*vip*
| sort hostname</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <initialValue>*</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>All Indexes associated with Host</title>
      <table>
        <title>Indexes</title>
        <search>
          <query>index=* host=$hostname$* |stats values(index) as index values(sourcetype) as sourcetype values(source) as source</query>
          <earliest>-7d@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>Missing DMZ Hosts</title>
      <table>
        <title>List of hosts in the DMZ that are not reporting in total</title>
        <search>
          <query>| inputlookup missing_dmzhosts.csv 
| search NOT host=*VIP*
| lookup dnslookup clienthost as host OUTPUT clientip as IP 
| join type=outer IP 
    [ inputlookup gennery_espinoza_assets.csv] 
| table host, IP, Director</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

Re: How do you show a row count in a dashboard panel?

493669 — Wed, 03 Oct 2018 04:48:57 GMT

Try this:

<panel>
       <title>Missing DMZ Hosts</title>
       <table>
         <title>List of hosts in the DMZ that are not reporting in total $count$</title>
         <search>
           <query>| inputlookup missing_dmzhosts.csv 
 | search NOT host=*VIP*
 | lookup dnslookup clienthost as host OUTPUT clientip as IP 
 | join type=outer IP 
     [ inputlookup gennery_espinoza_assets.csv] 
 | table host, IP, Director</query>
           <earliest>-24h@h</earliest>
           <latest>now</latest>
           <progress>
                <set token="count">$job.resultCount$</set>
          </progress>
         </search>
         <option name="drilldown">none</option>
         <option name="refresh.display">progressbar</option>
       </table>
     </panel>

Here created token name-count and saved query result count in it.

Re: How do you show a row count in a dashboard panel?

edwardrose — Wed, 03 Oct 2018 16:26:44 GMT

That works awesome. Thanks a lot

-ed

topic Re: How do you show a row count in a dashboard panel? in Splunk Search

How do you show a row count in a dashboard panel?

Re: How do you show a row count in a dashboard panel?

Re: How do you show a row count in a dashboard panel?