Splunk Search

How to display number of search results as single value?

SimonSchoppel
Explorer

I want to display the number of sent data in certain time in the dashboard. I think the best way is with "Single Value".
How can I display the number of search results of a search in the dashboard?

For example my search ("message.additionalInfo.attributes.properties.receiver-market-partner-id"=12345678) finds 1500 events. How can I display the 1500 in the dashboard as a single value?

Thanks a lot!

Translated with www.DeepL.com/Translator (free version)

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @SimonSchoppel,

you have to create a search with a "stats count" statement  at the end, something like this:

<your_search>
| stats count

In this way, you have as result a single number to display in a Single Value panel.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @SimonSchoppel,

you have to create a search with a "stats count" statement  at the end, something like this:

<your_search>
| stats count

In this way, you have as result a single number to display in a Single Value panel.

Ciao.

Giuseppe

SimonSchoppel
Explorer

Thank you!!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @SimonSchoppel,

good for you, see next time!

Please accept one answer for the other people of Community

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...

Auto-Injector for Everything Else: Making OpenTelemetry Truly Universal

You might have seen Splunk’s recent announcement about donating the OpenTelemetry Injector to the ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...