Dashboards & Visualizations

simple XML Results Panel : table : Display count of results

hartfoml
Motivator

I have a form dashboard that return results in a table format with potently more than 10,000 rows.

I have been asked if i can show the total number of results at the top of the table

I have this results view


<panel>
<title>Hardware Lookup</title>
<table>
<title>Matching events</title>
<option name="count">10</option>
</table>
</panel>

I found this answer by @sideview
In a dashboard panel, how would I get the result count to show (with paging)?
I just could not find where to put this code in the HTML to make it work

What option can I use or what module to show the total count of rows returned for the form search?
Oh an were in the HTML would I put the module. I know where to put the option.

Tags (2)

lakromani
Builder

Some old question, but here is a way to do it with an example.

I do calculate the number of rows in an input dopdown box.
Then set the output of it as default to the variable.
The input is then hidden with depends="$hidden$"

This should work for all as it counts the indexes used from _internal

<form>
  <label>Test hit counter in title</label>
  <fieldset autoRun="true" submitButton="false">
    <input type="time" token="global_time" searchWhenChanged="true">
      <label>Time frame</label>
      <default>Last 24 hours</default>
    </input>
    <input depends="$hidden$" type="dropdown" token="Counter" searchWhenChanged="true">
      <label>Counter</label>
      <!--<choice value="foo">Foo</choice>-->
      <search>
        <query>index=_internal
          | top limit=20 sourcetype
          | stats count</query>
        <earliest>$global_time.earliest$</earliest>
        <latest>$global_time.latest$</latest>
      </search>
      <fieldForLabel>count</fieldForLabel>
      <fieldForValue>count</fieldForValue>
      <selectFirstChoice>true</selectFirstChoice>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Number of indexes: $Counter$</title>
      <chart>
        <search>
          <query>index=_internal 
            | top limit=20 sourcetype</query>
          <earliest>$global_time.earliest$</earliest>
          <latest>$global_time.latest$</latest>
        </search>
        <option name="charting.chart">bar</option>
      </chart>
    </panel>
  </row>
</form>
0 Karma

cblanton
Communicator

this is kind of brilliant! there had to be a way. @hartfoml you should accept this answer. thank you @lakromani!

0 Karma

woodcock
Esteemed Legend

You can just add this to your search to put it to the side (I know that isn't the same as on top):

appendpipe [|stats count]
0 Karma

lguinn2
Legend

What is your search? Perhaps what you want can be accomplished by changing your search instead of changing the dashboard.

0 Karma

hartfoml
Motivator

I am using the dbquery to look for rows in a database table.

When I run the search in the search app i can see the number of rows returned.

When I use the Forms dashboard for my users I can not see the number of rows returned.

Can I use the form dashboard to do two query's one to do Select count(*) and one to do select *
then present the data under the count of the rows returned?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The answer you cite applies to advanced XML, not simple XML.

---
If this reply helps you, Karma would be appreciated.
0 Karma

hartfoml
Motivator

Thanks @richgalloway for the help, I think the answer from other posts " this is not possible in simple xml. I really was hoping that I didn't have to put in a feature request.

0 Karma
Get Updates on the Splunk Community!

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...