Dashboards & Visualizations

How do I get my token based value to not show a $result.total$ output???

briancronrath
Contributor

I want a $total$ variable in a dashboard to apply to a label of one of my panels. I want it to just say (loading..) while the search loads, and then only switch to the number once the search that assigns the token completes.

I init the variable to the loading value

<init>
<set token="total">(loading...)</set>
</init>

And then, I set the variable when a search is supposed to be done

<search>
<query>
blah blah blah a search that outputs one row, which is a stats output for a total</query>
<done>
<condition match="'job.resultCount'!=0">
<set token="total">$result.Total$</set>
</condition>
</done>
</search>

And then, I write in to one of my labels to display $total$

Basically what happens, is that the (loading...) text displays only for a short while, and instead, it quickly just pops up the "$result.Total$" text for a long while, while the search loads, and even far after the search should be completed by. It isn't until a good amount of time later that the number actually populates. Other variants I've tried are to use finalized instead of done, and also to not do the condition check. Every single one produces roughly the same behavior.

How am I suppose to actually prevent the $result.Total$ text from being displayed? I Only want to assign that token value when the search is done. Apparently "done" isn't done in this case.

Is there something I'm missing here?

0 Karma

niketn
Legend

@briancronrath you do not need to unset the token rather default to Loading.... unset would be useful when you have to toggle between showing and hiding or any element depending on search state in progress or completed (refer to answer: https://answers.splunk.com/answers/587113/change-refresh-progress-bar-to-spinning-wheel-in-s.html).

Try the following which is as per your use-case:

<dashboard>
  <label>Loading Completed</label>
  <row>
    <panel>
      <title>Splunk Errors ($tokResults$)</title>
      <chart>
        <search>
          <query>index=_internal sourcetype=splunkd log_level!=INFO
          | timechart span=1m count
          </query>
          <earliest>-1d@d</earliest>
          <latest>-0d@d</latest>
          <progress>
            <set token="tokResults">Loading...</set>
          </progress>
          <done>
            <set token="tokResults">$job.resultCount$</set>
          </done>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.drilldown">all</option>
      </chart>
    </panel>
  </row>
</dashboard>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

tomawest
Path Finder

Have you tried this:

     <search>
       <query>
         blah blah blah a search that outputs one row, which is a stats output for a total</query>
       <done>
         <condition match="'job.resultCount'!=0">
           <set token="total">$result.Total$</set>
         </condition>
         <condition>
           <unset token="total"/>
         </condition>
       </done>
       <progress>
         <unset token="total"/>
       </progress>
     </search>
0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

hi @briancronrath

Are you still having trouble with this issue? If so, please answer the commenter above so that they can help you further. Or, if you solved your query, would you mind describing the steps you took as an answer below so that others can learn from your solution?

Thanks for posting!

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...