example file : Stocks.csv
Stock ticker | Stock price |
IBM | 120 |
NFLX | 240 |
APPL | 999 |
And in the dashboard it will show:
Number of stocks selected by input | 3 |
User has a text input where they can put a search term that will search both columns at once. ( The token for the search query is $Stocks$)
If the user puts in say "L"
This is what will return :
Stock ticker | Stock price |
NFLX | 240 |
APPL | 999 |
And in the dashboard it will show:
Number of stocks selected by input | 2 |
I've tried this query :
|inputlookup Stocks.csv |stats count as Total ( which only gets the total number of stocks back in the csv file.... NOT the actual number of stocks selected by the user from their text input......)
However is there any way possible to get the " Number of stocks selected by input" correctly ?
@learningsplunk try the following, where token from the text box is $Stocks$
| inputlookup Stocks.csv where Stock_ticker="*$Stocks$*"
| stats count
@learningsplunk try the following, where token from the text box is $Stocks$
| inputlookup Stocks.csv where Stock_ticker="*$Stocks$*"
| stats count
One other question to add to this ,if there were multiple columns, for example :
Stock Ticker | Stock price | Company Name | Address | Owner |
IBM | 120 | IBM | 1 Main Street | Neera |
NFLX | 240 | Netflix | 23 Exchange Blvd | Jill |
EE | 360 | Eric's Electric | 999 Ways And Means | Eric |
Spl | 480 | Splunk | 10 Joseph Street | Paul |
And the user typed in "ee"
I've tried with :
| inputlookup Stocks.csv where Stock_ticker="*$Stocks$*"|where Stock_price="*$Stocks$*" |where Company_Name ="*$Stocks$*" |where Address ="*$Stocks$*" |where Owner ="*$Stocks$*"
| stats count
and the return value is always 0..... is there a way to return the number of rows 3, instead of returning an incorrect value of 0 or returning an incorrect value of 4 ?
Well then, looks like it works,! Wasn't aware that you could use the token to actually pass said value(s) in that statement.
@learningsplunk this would be a good Doc page to start reading about Tokens in Dashboards: https://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens