How do I get my token based value to not show a $result.total$ output???

[briancronrath]

I want a $total$ variable in a dashboard to apply to a label of one of my panels. I want it to just say (loading..) while the search loads, and then only switch to the number once the search that assigns the token completes.

I init the variable to the loading value

<init>
<set token="total">(loading...)</set>
</init>

And then, I set the variable when a search is supposed to be done

<search>
<query>
blah blah blah a search that outputs one row, which is a stats output for a total</query>
<done>
<condition match="'job.resultCount'!=0">
<set token="total">$result.Total$</set>
</condition>
</done>
</search>

And then, I write in to one of my labels to display $total$

Basically what happens, is that the (loading...) text displays only for a short while, and instead, it quickly just pops up the "$result.Total$" text for a long while, while the search loads, and even far after the search should be completed by. It isn't until a good amount of time later that the number actually populates. Other variants I've tried are to use finalized instead of done, and also to not do the condition check. Every single one produces roughly the same behavior.

How am I suppose to actually prevent the $result.Total$ text from being displayed? I Only want to assign that token value when the search is done. Apparently "done" isn't done in this case.

Is there something I'm missing here?

[niketn]

@briancronrath you do not need to unset the token rather default to Loading.... unset would be useful when you have to toggle between showing and hiding or any element depending on search state in progress or completed (refer to answer: https://answers.splunk.com/answers/587113/change-refresh-progress-bar-to-spinning-wheel-in-s.html).

Try the following which is as per your use-case:

<dashboard>
  <label>Loading Completed</label>
  <row>
    <panel>
      <title>Splunk Errors ($tokResults$)</title>
      <chart>
        <search>
          <query>index=_internal sourcetype=splunkd log_level!=INFO
          | timechart span=1m count
          </query>
          <earliest>-1d@d</earliest>
          <latest>-0d@d</latest>
          <progress>
            <set token="tokResults">Loading...</set>
          </progress>
          <done>
            <set token="tokResults">$job.resultCount$</set>
          </done>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.drilldown">all</option>
      </chart>
    </panel>
  </row>
</dashboard>

[tomawest]

Have you tried this:

     <search>
       <query>
         blah blah blah a search that outputs one row, which is a stats output for a total</query>
       <done>
         <condition match="'job.resultCount'!=0">
           <set token="total">$result.Total$</set>
         </condition>
         <condition>
           <unset token="total"/>
         </condition>
       </done>
       <progress>
         <unset token="total"/>
       </progress>
     </search>

[mstjohn_splunk]

hi @briancronrath

Are you still having trouble with this issue? If so, please answer the commenter above so that they can help you further. Or, if you solved your query, would you mind describing the steps you took as an answer below so that others can learn from your solution?

Thanks for posting!