Dashboards & Visualizations

simple XML Results Panel : table : Display count of results

hartfoml
Motivator

I have a form dashboard that return results in a table format with potently more than 10,000 rows.

I have been asked if i can show the total number of results at the top of the table

I have this results view


<panel>
<title>Hardware Lookup</title>
<table>
<title>Matching events</title>
<option name="count">10</option>
</table>
</panel>

I found this answer by @sideview
In a dashboard panel, how would I get the result count to show (with paging)?
I just could not find where to put this code in the HTML to make it work

What option can I use or what module to show the total count of rows returned for the form search?
Oh an were in the HTML would I put the module. I know where to put the option.

Tags (2)

lakromani
Builder

Some old question, but here is a way to do it with an example.

I do calculate the number of rows in an input dopdown box.
Then set the output of it as default to the variable.
The input is then hidden with depends="$hidden$"

This should work for all as it counts the indexes used from _internal

<form>
  <label>Test hit counter in title</label>
  <fieldset autoRun="true" submitButton="false">
    <input type="time" token="global_time" searchWhenChanged="true">
      <label>Time frame</label>
      <default>Last 24 hours</default>
    </input>
    <input depends="$hidden$" type="dropdown" token="Counter" searchWhenChanged="true">
      <label>Counter</label>
      <!--<choice value="foo">Foo</choice>-->
      <search>
        <query>index=_internal
          | top limit=20 sourcetype
          | stats count</query>
        <earliest>$global_time.earliest$</earliest>
        <latest>$global_time.latest$</latest>
      </search>
      <fieldForLabel>count</fieldForLabel>
      <fieldForValue>count</fieldForValue>
      <selectFirstChoice>true</selectFirstChoice>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Number of indexes: $Counter$</title>
      <chart>
        <search>
          <query>index=_internal 
            | top limit=20 sourcetype</query>
          <earliest>$global_time.earliest$</earliest>
          <latest>$global_time.latest$</latest>
        </search>
        <option name="charting.chart">bar</option>
      </chart>
    </panel>
  </row>
</form>
0 Karma

cblanton
Communicator

this is kind of brilliant! there had to be a way. @hartfoml you should accept this answer. thank you @lakromani!

0 Karma

woodcock
Esteemed Legend

You can just add this to your search to put it to the side (I know that isn't the same as on top):

appendpipe [|stats count]
0 Karma

lguinn2
Legend

What is your search? Perhaps what you want can be accomplished by changing your search instead of changing the dashboard.

0 Karma

hartfoml
Motivator

I am using the dbquery to look for rows in a database table.

When I run the search in the search app i can see the number of rows returned.

When I use the Forms dashboard for my users I can not see the number of rows returned.

Can I use the form dashboard to do two query's one to do Select count(*) and one to do select *
then present the data under the count of the rows returned?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The answer you cite applies to advanced XML, not simple XML.

---
If this reply helps you, Karma would be appreciated.
0 Karma

hartfoml
Motivator

Thanks @richgalloway for the help, I think the answer from other posts " this is not possible in simple xml. I really was hoping that I didn't have to put in a feature request.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...