When using the following Dashboard and check the job.resultCount for the table element, it returns the number of the base search $QUERY$
, not that of the filtered search $QUERY$ | where $FILTER$=1
. How do I obtain that number of results?
<dashboard>
<search id="baseSearch">
<query>$QUERY$</query>
</search>
<row>
<table>
<search base="baseSearch">
<query>| where $FILTER$=1</query>
<progress]
<condition match="'job.resultCount' ] 1">
<set token="check">true</set>
</condition>
<condition>
<set token="check">false</set>
</condition>
</progress>
</search>
</table>
</panel>
</row>
</dashboard>
Try like this
<dashboard stylesheet="eval_tokens.css">
<label>Eval Tokens</label>
<row>
<panel >
<chart>
<title>Top sourcetypes for index=_internal</title>
<search>
<query>index=_internal sdfdsfdfdfdf| top sourcetype</query>
<earliest>-2h</earliest>
<latest>now</latest>
<progress>
<eval token="duration">tonumber('job.resultCount')</eval>
</progress>
</search>
<h3>Duration</h3>
<div class="custom-result-value">$duration$</div>
</html>
<option name="charting.chart">bar</option>
</chart>
</panel>
</row>
</dashboard>