Dashboards & Visualizations

In Dashboard Studio using count of results in a different section

jwhughes58
Contributor

I'm working with Dashboard Studio for the first time and I've got a question.

Originally I created a table search that returns data depending on what is in the $servers_entered$ field.  That works.  I have been asked to add two single value fields.  The first is showing the number of servers in the $servers_entered$ field and that works.  The second is showing the number of servers in the table search.  There should be a way of linking that information, but I can't figure out how.  I could run the search again, but that is rather inefficient.

How do you tie the search result count from a table search to a single value field?

TIA,

Joe

Labels (4)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You can make the meta-data from the data source visible, then set up another search to use the meta-data tokens, such as resultCount for the search for the single value.

        "ds_tOBtSQ7e": {
            "type": "ds.search",
            "options": {
                "query": "index=_internal\n| stats count by sourcetype",
                "enableSmartSources": true,
                "queryParameters": {
                    "earliest": "-24h@h",
                    "latest": "now"
                }
            },
            "name": "Search_1"
        },
        "ds_aRrJ4C9T": {
            "type": "ds.search",
            "options": {
                "query": "| makeresults\n| fields - _time\n| eval count=$Search_1:job.resultCount$",
                "queryParameters": {
                    "earliest": "-24h@h",
                    "latest": "now"
                }
            },
            "name": "Search_3"
        }

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

You can make the meta-data from the data source visible, then set up another search to use the meta-data tokens, such as resultCount for the search for the single value.

        "ds_tOBtSQ7e": {
            "type": "ds.search",
            "options": {
                "query": "index=_internal\n| stats count by sourcetype",
                "enableSmartSources": true,
                "queryParameters": {
                    "earliest": "-24h@h",
                    "latest": "now"
                }
            },
            "name": "Search_1"
        },
        "ds_aRrJ4C9T": {
            "type": "ds.search",
            "options": {
                "query": "| makeresults\n| fields - _time\n| eval count=$Search_1:job.resultCount$",
                "queryParameters": {
                    "earliest": "-24h@h",
                    "latest": "now"
                }
            },
            "name": "Search_3"
        }

jwhughes58
Contributor

Thanks @ITWhisperer .  That is the solution.

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...