I did a dashboard panel that shows stats count results with a pie chart.
I'd like to show in the panel title the total number of events (not the result number).
I already used tokens to do this in other dashboards and usually runs well. This is an example:
<title>Status ($Antivirus_count$)</title> <search> <query>index=XXX ...| stats count by Status</query> <progress> <set token="Antivirus_count">$job.eventCount$</set> </progress> <cancelled> <unset token="Antivirus_count"></unset> </cancelled> .....
but in this last panel, I have a very long search string with three piped stats count and where clauses; at the end I have a stats count command to show.
I don't understand why in this panel, the result is always 0!
If I try to use as Token
job.resultCount instead of
job.eventCount, the title correctly shows the number of stats (2).
Anyone knows if there are situations where it's not possible to extract