Dashboards & Visualizations

Why is my $result.fieldname$ value isnt working?

patricianaguit
Explorer

The token i set for "$result.sum$" isn't working when i call it in title. Is there something wrong with my code?

     <search>
                <query>index="ape_idx" sourcetype="ape_csv" "Account Group" != "Infrastructure Services"  
                  | eval week = strptime(Reporting_Week,"%m/%d/%Y")  
                  | sort -week limit=0  | dedup "Project Id" 
                  | fillnull value=NA  | lookup geo_region_new "Dominant Geographic Unit" as "Geographic Unit" outputnew "Geographic Region" 
                  | search "Geographic Region" = "AAPAC" | stats count as "Project Count" by "Geographic Region","Geographic Unit" 
                  | eventstats sum("Project Count") as Sum | fields - "Geographic Region","Geographic Unit", "Project Count" | dedup Sum
               </query>
                    <done>
                        <set token="aapacCount">$result.Sum$</set>
                     </done>
          <!---end of search for total count of aapac-->
            <title>Total Count: $aapacCount$</title>
Tags (2)
0 Karma

niketn
Legend

@patricianaguit have you ensured that your search is returning result/s? Also do you have earliest and latest time tokens passed to the search? It seems to be missing in the sample code. Just to be sure that $result.Sum$ picks a value even if underlying search returned no results you can try the following:

<query>
   <yourQueryGoesHere>
</query>
<earliest><yourEarliestTimeHere></earliest>
<latest><yourLatestTimeHere></latest>
<done>
      <condition match="$job.resultCount$==0">
            <set token="aapacCount">0</set>
      </condition>
      <condition match="$job.resultCount$==0">
            <set token="aapacCount">$result.Sum$</set>
      </condition>
</done>
<row>
        <panel>
               <title>$aapacCount$</title>
        </panel>
</row>

Second reason could be that query is taking too long to run. So you can try <progress> event handler instead of done.

Just a question are you on Splunk 6.5 or Higher?

Besides the points about the Token, you search query needs some tweaking:
1) I dont see a use of week field created, hence sort also.
2) dedup should be performed right after getting events from the base search.
3) stats should be done first then lookup then filter.
4) If you need the Sum field alone, perform stats which will just retain Sum field and not eventstats followed by removal of unwanted fields.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

micahkemp
Champion

<title> isn't valid inside <search>, so it needs to be moved out. This run anywhere example shows what you're trying to accomplish, though:

<dashboard>
  <row>
    <panel>
      <title>$aapacCount$</title>
      <table>
        <search>
          <query>| tstats count WHERE index=* OR index=_*</query>
           <done>
              <set token="aapacCount">$result.count$</set>
            </done>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</dashboard>
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...