topic Re: mvcombine count all elements of the field in Splunk Search

mvcombine count all elements of the field

splunk6161 — Mon, 29 Jul 2019 13:57:22 GMT

I have a list of 5 elements:

After i use mvcombine i return only 1 result, but i have effectively 5 elements.

The $job.resultCount$ return 1, how to return 5?

Re: mvcombine count all elements of the field

jacobpevans — Mon, 29 Jul 2019 14:52:11 GMT

Try adding "count" to your stats function e.g.

| makeresults count=5
| eval Type="Product", ID=random()
| table ID, Type
| stats delim="; " list(ID) as ID *count* by Type
| mvcombine ID

then change $job.resultCount$ to $result.count$

If you still want the total count (if there are multiple Types), do the count before the list e.g.

| makeresults count=5
| eval Type="Product", ID=random()
| table ID, Type
| stats *count*
| stats delim="; " list(ID) as ID by Type count
| mvcombine ID

Re: mvcombine count all elements of the field

splunk6161 — Mon, 29 Jul 2019 15:42:03 GMT

The first answer work only if the column count is visible.
I tried with | field - count or | table Type ID but $result.count$ doesn't work.
While the second answer no result found

Re: mvcombine count all elements of the field

woodcock — Mon, 29 Jul 2019 17:54:18 GMT

Try this:

| makeresults count=5 
| eval TYPE="Protect", ID=random() 
| table ID TYPE 
| stats delim="; " count(ID) AS _count list(ID) AS ID BY TYPE 
| mvcombine ID

This makes the _count field invisible to the user but available with $result._count$ .

Re: mvcombine count all elements of the field

jacobpevans — Mon, 29 Jul 2019 19:05:32 GMT

edit: while this does work, I also tested @woodcock 's solution and it works and is much better than mine

Copy and paste this into a new dashboard. I think it has everything you need. I separated your search into a base search where one search returns the true count and the other returns the data you want. The token is then set from the count search instead of the result search.

<dashboard>
  <label>Test Dashboard</label>
  <search id="baseSearch">
    <query>| makeresults count=5 
| eval Type="Product", ID=random()</query>
    <earliest>-24h@m</earliest>
    <latest>now</latest>
  </search>
  <search base="baseSearch" id="countSearch">
    <query>stats count</query>
    <done>
     <set token="resultCount">$result.count$</set>
    </done>
  </search>
  <row>
    <html>
      resultCount: $resultCount$
    </html>
  </row>
  <row>
    <panel>
      <table>
        <search base="baseSearch">
          <query>stats delim="; " list(ID) as ID by Type 
| mvcombine ID</query>
        </search>
      </table>
    </panel>
  </row>
</dashboard>

Re: mvcombine count all elements of the field

splunk6161 — Tue, 30 Jul 2019 09:30:00 GMT

The token doesn't work, what is wrong?

<dashboard>
  <label>TEST_RESULTCOUNT</label>
  <row>
    <panel>
      <title>TOTALE:$totale$</title>
      <table>
        <search>
          <query>| makeresults count=5
| eval TYPE="Protect", ID=random()
| table ID TYPE
| stats delim="; " count(ID) as _count list(ID) as ID by TYPE 
| mvcombine ID</query>
          <earliest>0</earliest>
          <latest></latest>
          <sampleRatio>1</sampleRatio>
          <done>
            <condition>
              <set token="totale">$result._count$</set>
            </condition>
          </done>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</dashboard>

Re: mvcombine count all elements of the field

woodcock — Wed, 31 Jul 2019 05:07:50 GMT

I don't get it, I do this all the time. Install the Dashboard Examples app and check out the drilldown examples. Maybe your version has a bug?

Re: mvcombine count all elements of the field

splunk6161 — Wed, 31 Jul 2019 11:30:52 GMT

I don't known, i use 7.3.0 enterprise so i try to install Dashboard Examples

Re: mvcombine count all elements of the field

splunk6161 — Thu, 01 Aug 2019 14:21:08 GMT

Today I upgraded splunk to 7.3.1 but the $result._count$ still doesn't work.
I have seen all the examples but any helped me to find the solution.
I tried | eval count = _count to see if the count return a result, it works!.

Re: mvcombine count all elements of the field

woodcock — Thu, 01 Aug 2019 15:44:18 GMT

Included in the Dashboard Examples app you may have noticed a token debugger tool. This is available as a separate widget that you can add to any dashboard in the Developer Gadgets app that will help a great deal debugging your problem: https://splunkbase.splunk.com/app/3689/