dynamic single value to track number of completed search queries of dashboard

[ektasiwani]

Hi,

I have a dashboard with multiple panels.
Can we create a single value to keep track of completed queries.
Single value should change real time, as the number of completed search queries changes.

Is it possible to have something like this in Splunk dashboard or application.

[ektasiwani · Accepted solution]

Hi,

Solved this by using 'progress' tag inside 'search' tag of Dashboard.[https://docs.splunk.com/Documentation/Splunk/7.2.4/Viz/tokens]

<search>   
     <progress>
            <condition match="'job.resultCount' == 0">
              <set token="tok1Count">0</set>
            </condition>
            <condition>
              <set token="tok1Count">1</set>
            </condition>
      </progress>
</search>

[richgalloway]

@ektasiwani Please accept the answer to help future readers.

[richgalloway]

This should get you started. Put it in your favorite dashboard and run it once a minute. It will count the number of searches completed during the day and reset at midnight.

index=_internal sourcetype=scheduler result_count earliest=@d | stats count(result_count) as searchesCompleted 

[ektasiwani]

Hi Richgalloway,

My use case does not include getting scheduled search.
I have dashboard, and dashboard contain multiple search query. I want to display number showing 'number of search queries completed' from the dashboard

For example if dashboard has 10 search query and at this moment 4 queries gave the output and 6 query still running, 'number of search queries completed' should show 4 as output.

[richgalloway]

Thanks for clarifying. I'm not aware of a method to do that. Are progress bars on the panels not enough to let the users know searches are still running?

[ektasiwani]

Hi,

This is one of the requirement.