Dashboards & Visualizations

How to get the job.resultCount for a dashboard panel search, not the base search?

roukepouw
Explorer

When using the following Dashboard and check the job.resultCount for the table element, it returns the number of the base search $QUERY$, not that of the filtered search $QUERY$ | where $FILTER$=1. How do I obtain that number of results?

<dashboard>
<search id="baseSearch">
     <query>$QUERY$</query>
</search>
<row>
  <table>

      <search base="baseSearch">
        <query>| where $FILTER$=1</query>
        <progress]
            <condition match="'job.resultCount' ] 1">
                <set token="check">true</set>
            </condition>
            <condition>
                <set token="check">false</set>
            </condition>
        </progress>
    &lt;/search&gt;
  </table>
   </panel>
</row>
</dashboard>
0 Karma

somesoni2
Revered Legend

Try like this

<dashboard stylesheet="eval_tokens.css">
  <label>Eval Tokens</label>
  <row>
    <panel >
      <chart>
        <title>Top sourcetypes for index=_internal</title>
        <search>
          <query>index=_internal sdfdsfdfdfdf|  top sourcetype</query>
          <earliest>-2h</earliest>
          <latest>now</latest>
          <progress>
            <eval token="duration">tonumber('job.resultCount')</eval>
          </progress>
        </search>

      <h3>Duration</h3>
      <div class="custom-result-value">$duration$</div>
  </html>

        <option name="charting.chart">bar</option>
      </chart>
     </panel>
  </row>
</dashboard>
Get Updates on the Splunk Community!

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Get Inspired! We’ve Got Validation that Your Hard Work is Paying Off

We love our Splunk Community and want you to feel inspired by all your hard work! Eric Fusilero, our VP of ...

What's New in Splunk Enterprise 9.4: Features to Power Your Digital Resilience

Hey Splunky People! We are excited to share the latest updates in Splunk Enterprise 9.4. In this release we ...