topic Re: Can we display the total count of all fields inside a panel? in Splunk Search

Can we display the total count of all fields inside a panel?

splunker9999 — Tue, 16 Aug 2016 00:43:34 GMT

Hi,

Is there any possibility to display total count of all fields inside a panel?

We have pie chart that displays 5 fields with some values for each. Now we need to display something like "total" may be at top of the panel or bottom of the panel.

Can you please suggest?

Thanks

Re: Can we display the total count of all fields inside a panel?

skoelpin — Tue, 16 Aug 2016 00:53:10 GMT

This may be difficult. Check out this thread

https://answers.splunk.com/answers/91632/getting-a-count-of-the-number-of-fields-associated-with-a-sourcetype.html

Re: Can we display the total count of all fields inside a panel?

martin_mueller — Tue, 16 Aug 2016 01:46:15 GMT

If you compute the total in your search like so | addtotals fieldname=_total, you can refer to $result._total$ in an HTML panel or a panel title.

Note, that's assuming you have one row with five columns. If you have five rows with one column, you'll need to use | eventstats sum(yourcolumn) as _total to compute the total.

Re: Can we display the total count of all fields inside a panel?

sundareshr — Tue, 16 Aug 2016 01:56:56 GMT

You could do something like this... Here is an example with index=Internal but you should be able to adjust to your needs.

index=_internal sourcetype=splunkd_* | stats count by sourcetype | eventstats sum(count) as total | eval sourcetype=sourcetype." (".count."/".total.")" | fields - total

This will display the total in the field name

Re: Can we display the total count of all fields inside a panel?

Arun_N_007 — Tue, 16 Aug 2016 06:33:06 GMT

Hi,

Please correct me if am wrong,

You need a total count in the same panel of a pie chart?

It can be done using single value and pie chart in the same panel, here you need to use post process search picking total for single value and other values for pie chart.

Ex:-

Base search

..|eventstats sum(count) as Total|table Source,count,Total

Dependent Search 1 (For Pie chart)

table Source,count

Dependent Search 2 (For Single Value)

stats values(Total) as Total|table Total

If you don't want you use single value.

Use Java Script to find a total and set a token to display in the html tag inside a panel.

Re: Can we display the total count of all fields inside a panel?

splunker9999 — Tue, 16 Aug 2016 16:53:14 GMT

Hi, we have 5 rows with one column and i used the latter to my search.
| eventstats sum(yourcolumn) as _total

and tried calling this in my panel title $result._total$ as suggested, but value is not displaying in panel?

Is there anything need to do?

Thanks

Re: Can we display the total count of all fields inside a panel?

splunker9999 — Tue, 16 Aug 2016 16:55:15 GMT

Hi ,
Thanks, we are not looking to display in fieldname , instead some thing we are looking to display in title or some way inside panel is also fine?

Thanks

Re: Can we display the total count of all fields inside a panel?

martin_mueller — Tue, 16 Aug 2016 18:12:44 GMT

It seems I forgot one step, you need to make the token available outside your search. Here's a working example:

<panel>
  <title>$total$</title>
  <table>
    <search>
      <query>| tstats count where index=_internal by sourcetype | eventstats sum(count) as _total</query>
      <preview>
        <set token="total">$result._total$</set>
      </preview>
    </search>
  </table>
</panel>

Re: Can we display the total count of all fields inside a panel?

splunker9999 — Tue, 16 Aug 2016 18:30:33 GMT

Hi tried this, value is not displaying in title, it is displaying as "$result._total$"?

Re: Can we display the total count of all fields inside a panel?

martin_mueller — Tue, 16 Aug 2016 19:02:05 GMT

That's copied out of a working dashboard I built to check syntax etc., what exact XML are you using?

Re: Can we display the total count of all fields inside a panel?

splunker9999 — Tue, 16 Aug 2016 19:26:38 GMT

Below is my sample xml code used for this dashboard.

<single>
             <title>$total$</title>
            <search>
              <query>index=imdc_vms (sourcetype=hadoop:app:opera) (host=lgpbdpv035* OR host=lgpbdpv535* )  return_message="SUCCESS"   |eval Platform =if(sourcetype=="hadoop:app:opera", "OPERA","Fingerprint")   | search  Platform="*"  | eval item ="Success Requests" | stats dc(request_id) as Count by item,Platform | append [search  index=imdc_vms sourcetype=hadoop:app:tomcat:access source="*localhost_access_log*" (host=lgpbdpv035* OR host=lgpbdpv535* OR host=lgpbdpv050* OR host=lgpbdpv550*)  ( method=POST OR method =GET)  (uri="*opera*" OR uri ="*fingerprint*" )  | eval Platform=if(match(uri,".*opera.*"),"OPERA", "Fingerprint")   | search  Platform="*"  | eval item ="Total Requests" | stats count(uri) as Count by item,Platform | eval t_req= Count  ]  | append [search  index=imdc_vms sourcetype="hadoop:app:tomcat:catalina" ( host=lgpbdpv050* OR host=lgpbdpv550*)  "Call to Response * took *"  |eval Platform =if(sourcetype=="hadoop:app:opera", "OPERA","Fingerprint")   | search  Platform="*"  | eval item ="Success Requests" | stats dc(request_id) as Count by item,Platform | eval s_req= Count  ] | append [search index=imdc_vms sourcetype=hadoop:app:opera (host=lgpbdpv035* OR host=lgpbdpv535* )  ( EventDesc ="Got Request*" OR (EventDesc ="*Finished processing for request map*" AND tt_total &gt;1000) )  |eval Platform =if(sourcetype=="hadoop:app:opera", "OPERA","Fingerprint")    | search  Platform="*"  | eval item ="Error Requests" | transaction host pub_guid startswith="Got Request*" endswith="*Finished processing for request map*" maxevents=2 |stats count as Count by item,Platform  ] | eval Platform = Platform +":"+ item +": "+ Count
                | table  Platform, Count| eventstats sum(Count) as total|fields - Platform Count|head 1
               </query>
              <progress>
             <set token="total">$result.total$</set>
           </progress>

Re: Can we display the total count of all fields inside a panel?

martin_mueller — Tue, 16 Aug 2016 19:59:16 GMT

Sigh... for some reason I pasted the wrong version - you'll need the preview search event handler, not progress... that one only has job properties. http://docs.splunk.com/Documentation/Splunk/6.4.2/Viz/EventHandlerReference#preview

Re: Can we display the total count of all fields inside a panel?

splunker9999 — Tue, 16 Aug 2016 22:24:49 GMT

awesome...that works.

I used finalized.

Thank you very much.