Knowledge Management

How do i display the total number of unique records per row? See the attached image.

ronniemakhombi
Explorer

I want to print the total on the statistics tab.

Tags (1)
0 Karma

niketn
Legend

Try the following run anywhere example. You can use <progress> or <done> search event handler depending on your use case to capture the number of results returned by a search using a predefined token $job.resultCount$

<dashboard>
  <label>Table Result Count</label>
  <row>
    <panel>
      <title>My Search (Results: $tokResultCount$)</title>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd
| stats count by component           
          </query>
          <earliest>-1h@h</earliest>
          <latest>now</latest>
          <progress>
            <set token="tokResultCount">$job.resultCount$</set>
          </progress>
        </search>
      </table>
    </panel>
  </row>
</dashboard>

Refer to documentation: https://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Search_event_elements_and_job_propert...

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

@ronniemakhombi the expected output is still not clear. For the community to assist you better please add further details as to which value is the total and where is it going to be displayed. Also whether this request is for Dashboard or not?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

ronniemakhombi
Explorer

Thank you for your comment, I want to display the total number of events/records. for example in the snippet attached, there are five records (5). Is there a way i can print this out or display this number.

0 Karma

p_gurav
Champion

Do you want total of ACC_NBR column?

0 Karma

ronniemakhombi
Explorer

Thank you for your comment, I want to display the total number of events/records. for example in the snippet attached, there are five records (5). Is there a way i can print this out or display this number.

0 Karma

p_gurav
Champion

Can you try :
| stats count by ACC_NBR

0 Karma

harishalipaka
Motivator

@ronniemakhombi
you can go with my code|dedup ACC_NBR |stats count

Thanks
Harish
0 Karma

ronniemakhombi
Explorer

No, I want to print or display 86 513 for reporting

0 Karma

harishalipaka
Motivator

@ronniemakhmbi

add end of your query like this

|dedup ACC_NBR  |stats count
Thanks
Harish
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Synthetic Monitoring - Resolved Incident on Detector Alerts

We’ve discovered a bug that affected the auto-clear of Synthetic Detectors in the Splunk Synthetic Monitoring ...

Video | Tom’s Smartness Journey Continues

Remember Splunk Community member Tom Kopchak? If you caught the first episode of our Smartness interview ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud? Learn how unique features like ...