Dashboards & Visualizations

Token Flicking to 0 then the number i needed

robertlynch2020
Influencer

Hi

I am using a base search to display a token.

However, I noticed it flicks to 0 then the number I need.

I need something like this -  <!--condition match=" $result.count$ != 0"--> but there is also a case where I need it to be 0. So how can I get it to display the number only when the job is 100% done. I have tried done, finalised but they all display the 0 at the wrong time and then it changes to the correct number.

i have also tried to add in  <condition match=" $job.resultCount$ == 1"> but I still get the 0 and then the number I need

 

<search base="basesearch_MAIN">
    <!-- FInd out how many process are being monitored -->
    <query>| stats count </query>
    <progress>
	
      <set token="Token_no_of_Process">$result.count$</set>
  
	</progress>
  </search>

 

 

robertlynch2020_0-1627032561974.png

 

Labels (1)
0 Karma

jhanvidattani
Path Finder

@robertlynch2020 

I have unset token Token_no_of_Process whenever there is a change in Time Picker. Due to this,  the value of the token would be set every time, as the base search will be executed due to a change in the token.

 

Also, if you calculate value when by appending | stats count then even if the output is zero job.resultCount will have value 1 (because one result with value zero is returned). Hence it would be preferable to calculate in the base search query.

 

Can you try the below solution?

<form>
  <search id="basesearch_MAIN">
    <query>index="_internal" | dedup sourcetype | table sourcetype</query>
    <earliest>$time_token.earliest$</earliest>
    <latest>$time_token.latest$</latest>
  </search>
  <label>test</label>
  <fieldset submitButton="false">
    <input type="time" token="time_token" searchWhenChanged="true">
      <label></label>
      <default>
        <earliest>-4h@h</earliest>
        <latest>now</latest>
      </default>
      <change>
        <unset token="Token_no_of_Process"></unset>
      </change>
    </input>
  </fieldset>
  <row>
    <panel depends="$never_show_this_panel$">
      <single>
        <title>Test Count</title>
        <search base="basesearch_MAIN">
          <done>
            <condition match="'job.resultCount'==0">
              <set token="Token_no_of_Process">Zero Count</set>
            </condition>
            <condition>
              <set token="Token_no_of_Process">Non-Zero</set>
            </condition>
          </done>
        </search>
      </single>
    </panel>
    <panel depends="$Token_no_of_Process$">
      <single>
        <title>Test Count $Token_no_of_Process$ </title>
        <search base="basesearch_MAIN">
          <query>| stats count</query>
        </search>
      </single>
    </panel>
  </row>
</form>

 

robertlynch2020
Influencer

Hi

This seems to work and thanks for your answer.

Regards

Robert Lynch

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Brett Adams

In our third Spotlight feature, we're excited to shine a light on Brett—a Splunk consultant, innovative ...

Index This | What can you do to make 55,555 equal 500?

April 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...