topic Which search commands allow you to display search property values in a table or dashboard? in Splunk Search

Which search commands allow you to display search property values in a table or dashboard?

kplatte — Mon, 09 Jan 2017 21:53:46 GMT

Which search commands allow you to display search property values in a table or dashboard? I am referring specifically to scanCount and resultCount . How can I add resultCount, scanCount to a table?

Thanks in advance!
Kyle

Re: Which search commands allow you to display search property values in a table or dashboard?

somesoni2 — Mon, 09 Jan 2017 23:28:16 GMT

I don't believe there is a search command provides all those properties. However, in Splunk 6.3+ onwards, the panel <search> element provides event handler which exposes those job properties. So, you can use event handle which have access to job properties (<progress> and <done>), then you can use a eval/set option to get those job properties to a token that can be used to display the same elsewhere (not in the search result, but to a label/title/html).

http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/EventHandlerReference#Search_event_handlers
http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/tokens#Search_event_elements_and_job_properties

Re: Which search commands allow you to display search property values in a table or dashboard?

Lucas_K — Tue, 10 Jan 2017 04:33:15 GMT

Here ya go example code at the bottom.

Explanation.
Create an eval via a progress tag.
Then insert that new eval somewhere on your dashboard.

Any of the job tokens can be grabbed in the same manner.

<dashboard>
  <label>Token Example</label>
  <row>
    <panel>
      <search id="search_logic">
        <query>index=_internal  sourcetype=splunkd|  top sourcetype</query>
                  <earliest>-1m</earliest>
          <latest>now</latest>

        <progress>
          <eval token="scancount">$job.scanCount$</eval>
          <eval token="resultcount">$job.resultCount$</eval>
        </progress>
      </search>

      <chart>
        <title>Top sourcetypes for index=_internal</title>
        <search base="search_logic" />
        <option name="charting.chart">bar</option>
      </chart>
      <html>
          <h3>Scancount : $scancount$</h3>
          <h3>resultcount : $resultcount$</h3>
      </html>
    </panel>
  </row>
</dashboard>

Re: Which search commands allow you to display search property values in a table or dashboard?

gcusello — Tue, 10 Jan 2017 09:17:01 GMT

Hi kplatte,
if you want to add to your table a column with the total count of events you could run something like this:

index=_internal | eventstats count AS cnt | stats values(cnt) AS cnt count by host

if instead you want to have the number of events outside the panel (e.g. in the Panel's Title), you have to insert in your search something like this:

<progress>
   <eval token="scancount">$job.scanCount$</eval>
   <eval token="resultcount">$job.resultCount$</eval>
</progress>

and use the token.

Bye.
Giuseppe

Re: Which search commands allow you to display search property values in a table or dashboard?

aaraneta_splunk — Sun, 22 Jan 2017 01:02:20 GMT

@kplatte - Looks like you have a few possible solutions to your question. If one of them provided a working solution, please don't forget to click "Accept" below the best answer to resolve this post. If you still need help, please leave a comment. Don’t forget to upvote anything that was helpful too. Thanks!