Knowledge Management

How do i display the total number of unique records per row? See the attached image.

ronniemakhombi
Explorer

I want to print the total on the statistics tab.

Tags (1)
0 Karma

niketn
Legend

Try the following run anywhere example. You can use <progress> or <done> search event handler depending on your use case to capture the number of results returned by a search using a predefined token $job.resultCount$

<dashboard>
  <label>Table Result Count</label>
  <row>
    <panel>
      <title>My Search (Results: $tokResultCount$)</title>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd
| stats count by component           
          </query>
          <earliest>-1h@h</earliest>
          <latest>now</latest>
          <progress>
            <set token="tokResultCount">$job.resultCount$</set>
          </progress>
        </search>
      </table>
    </panel>
  </row>
</dashboard>

Refer to documentation: https://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Search_event_elements_and_job_propert...

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

@ronniemakhombi the expected output is still not clear. For the community to assist you better please add further details as to which value is the total and where is it going to be displayed. Also whether this request is for Dashboard or not?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

ronniemakhombi
Explorer

Thank you for your comment, I want to display the total number of events/records. for example in the snippet attached, there are five records (5). Is there a way i can print this out or display this number.

0 Karma

p_gurav
Champion

Do you want total of ACC_NBR column?

0 Karma

ronniemakhombi
Explorer

Thank you for your comment, I want to display the total number of events/records. for example in the snippet attached, there are five records (5). Is there a way i can print this out or display this number.

0 Karma

p_gurav
Champion

Can you try :
| stats count by ACC_NBR

0 Karma

harishalipaka
Motivator

@ronniemakhombi
you can go with my code|dedup ACC_NBR |stats count

Thanks
Harish
0 Karma

ronniemakhombi
Explorer

No, I want to print or display 86 513 for reporting

0 Karma

harishalipaka
Motivator

@ronniemakhmbi

add end of your query like this

|dedup ACC_NBR  |stats count
Thanks
Harish
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...

Data Persistence in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. What happens if the OpenTelemetry collector ...