Knowledge Management

How do i display the total number of unique records per row? See the attached image.

ronniemakhombi
Explorer

I want to print the total on the statistics tab.

Tags (1)
0 Karma

niketn
Legend

Try the following run anywhere example. You can use <progress> or <done> search event handler depending on your use case to capture the number of results returned by a search using a predefined token $job.resultCount$

<dashboard>
  <label>Table Result Count</label>
  <row>
    <panel>
      <title>My Search (Results: $tokResultCount$)</title>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd
| stats count by component           
          </query>
          <earliest>-1h@h</earliest>
          <latest>now</latest>
          <progress>
            <set token="tokResultCount">$job.resultCount$</set>
          </progress>
        </search>
      </table>
    </panel>
  </row>
</dashboard>

Refer to documentation: https://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Search_event_elements_and_job_propert...

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

@ronniemakhombi the expected output is still not clear. For the community to assist you better please add further details as to which value is the total and where is it going to be displayed. Also whether this request is for Dashboard or not?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

ronniemakhombi
Explorer

Thank you for your comment, I want to display the total number of events/records. for example in the snippet attached, there are five records (5). Is there a way i can print this out or display this number.

0 Karma

p_gurav
Champion

Do you want total of ACC_NBR column?

0 Karma

ronniemakhombi
Explorer

Thank you for your comment, I want to display the total number of events/records. for example in the snippet attached, there are five records (5). Is there a way i can print this out or display this number.

0 Karma

p_gurav
Champion

Can you try :
| stats count by ACC_NBR

0 Karma

harishalipaka
Motivator

@ronniemakhombi
you can go with my code|dedup ACC_NBR |stats count

Thanks
Harish
0 Karma

ronniemakhombi
Explorer

No, I want to print or display 86 513 for reporting

0 Karma

harishalipaka
Motivator

@ronniemakhmbi

add end of your query like this

|dedup ACC_NBR  |stats count
Thanks
Harish
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf25, and our Community

Thank you to everyone in the Splunk Community who joined us for .conf25, which kicked off with our iconic ...

Data Persistence in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. What happens if the OpenTelemetry collector ...

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever

Now On Demand Whether you're managing complex deployments or looking to future-proof your data ...