Splunk Search

How to display number of search results as single value?

SimonSchoppel
Explorer

I want to display the number of sent data in certain time in the dashboard. I think the best way is with "Single Value".
How can I display the number of search results of a search in the dashboard?

For example my search ("message.additionalInfo.attributes.properties.receiver-market-partner-id"=12345678) finds 1500 events. How can I display the 1500 in the dashboard as a single value?

Thanks a lot!

Translated with www.DeepL.com/Translator (free version)

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @SimonSchoppel,

you have to create a search with a "stats count" statement  at the end, something like this:

<your_search>
| stats count

In this way, you have as result a single number to display in a Single Value panel.

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @SimonSchoppel,

you have to create a search with a "stats count" statement  at the end, something like this:

<your_search>
| stats count

In this way, you have as result a single number to display in a Single Value panel.

Ciao.

Giuseppe

SimonSchoppel
Explorer

Thank you!!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @SimonSchoppel,

good for you, see next time!

Please accept one answer for the other people of Community

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...