I'm working with Dashboard Studio for the first time and I've got a question.
Originally I created a table search that returns data depending on what is in the $servers_entered$ field. That works. I have been asked to add two single value fields. The first is showing the number of servers in the $servers_entered$ field and that works. The second is showing the number of servers in the table search. There should be a way of linking that information, but I can't figure out how. I could run the search again, but that is rather inefficient.
How do you tie the search result count from a table search to a single value field?
TIA,
Joe
You can make the meta-data from the data source visible, then set up another search to use the meta-data tokens, such as resultCount for the search for the single value.
"ds_tOBtSQ7e": {
"type": "ds.search",
"options": {
"query": "index=_internal\n| stats count by sourcetype",
"enableSmartSources": true,
"queryParameters": {
"earliest": "-24h@h",
"latest": "now"
}
},
"name": "Search_1"
},
"ds_aRrJ4C9T": {
"type": "ds.search",
"options": {
"query": "| makeresults\n| fields - _time\n| eval count=$Search_1:job.resultCount$",
"queryParameters": {
"earliest": "-24h@h",
"latest": "now"
}
},
"name": "Search_3"
}
You can make the meta-data from the data source visible, then set up another search to use the meta-data tokens, such as resultCount for the search for the single value.
"ds_tOBtSQ7e": {
"type": "ds.search",
"options": {
"query": "index=_internal\n| stats count by sourcetype",
"enableSmartSources": true,
"queryParameters": {
"earliest": "-24h@h",
"latest": "now"
}
},
"name": "Search_1"
},
"ds_aRrJ4C9T": {
"type": "ds.search",
"options": {
"query": "| makeresults\n| fields - _time\n| eval count=$Search_1:job.resultCount$",
"queryParameters": {
"earliest": "-24h@h",
"latest": "now"
}
},
"name": "Search_3"
}
Thanks @ITWhisperer . That is the solution.