Splunk is 8.0.2.1.
Somewhat similar to https://answers.splunk.com/answers/48050/strange-behaviour-with-count-in-stats-when-using-macros.htm...
My query ends in | stats count and works fine when run from Search (selecting the single value visualization). It also worked fine as a dashboard, until I turned it into a macro. Now, it shows count of 1, like it's counting the number of fields returned. Tables work just fine. Also using this app, to have dropdowns, however, panel in question is not the dropdown: https://splunkbase.splunk.com/app/3689/
Snippet from my dashboard:
<row>
<panel id="pn03">
<single>
<title>Location</title>
<search>
<query>`getactiveuserscount(192.168.0.%)`</query>
<earliest>-11m@m</earliest>
<latest>now</latest>
<refresh>2m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="colorMode">block</option>
<option name="drilldown">none</option>
<option name="height">50</option>
<option name="rangeColors">["0xcccccc","0x53a051","0xf8be34","0xf1813f","0xdc4e41"]</option>
<option name="rangeValues">[0,5,10,20]</option>
<option name="refresh.display">progressbar</option>
<option name="useColors">1</option>
<drilldown>
<link target="_blank">/app/TA-myapp-it/dashboard__active_users</link>
</drilldown>
</single>
</panel>
</row>
Macro:
index="main" source="C:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\default_app\\bin\\Get-Active-Users.bat"
| eval Status=mvindex(split(_raw,","), 1)
| eval Status=case(Status="unsure", "Multiple User Sessions", 1=1, Status)
| search Status="unlocked"
| dedup host
| eval Username=mvindex(split(_raw,","), 0)
| eval ipaddr=mvindex(split(_raw,","), 2)
| eval IP_Address=mvindex(split(ipaddr,"."), 0). ".". mvindex(split(ipaddr,"."), 1). ".". mvindex(split(ipaddr,"."), 2). ".1"
| where like(IP_Address,"$ip$")
| stats count
