Which search commands allow you to display search ...

kplatte · ‎01-09-2017

Which search commands allow you to display search property values in a table or dashboard? I am referring specifically to scanCount and resultCount . How can I add resultCount, scanCount to a table?

Thanks in advance!
Kyle

aaraneta_splunk · ‎01-21-2017

@kplatte - Looks like you have a few possible solutions to your question. If one of them provided a working solution, please don't forget to click "Accept" below the best answer to resolve this post. If you still need help, please leave a comment. Don’t forget to upvote anything that was helpful too. Thanks!

gcusello · ‎01-10-2017

Hi kplatte,
if you want to add to your table a column with the total count of events you could run something like this:

index=_internal | eventstats count AS cnt | stats values(cnt) AS cnt count by host

if instead you want to have the number of events outside the panel (e.g. in the Panel's Title), you have to insert in your search something like this:

<progress>
   <eval token="scancount">$job.scanCount$</eval>
   <eval token="resultcount">$job.resultCount$</eval>
</progress>

and use the token.

Bye.
Giuseppe

Lucas_K · ‎01-09-2017

Here ya go example code at the bottom.

Explanation.
Create an eval via a progress tag.
Then insert that new eval somewhere on your dashboard.

Any of the job tokens can be grabbed in the same manner.

<dashboard>
  <label>Token Example</label>
  <row>
    <panel>
      <search id="search_logic">
        <query>index=_internal  sourcetype=splunkd|  top sourcetype</query>
                  <earliest>-1m</earliest>
          <latest>now</latest>

        <progress>
          <eval token="scancount">$job.scanCount$</eval>
          <eval token="resultcount">$job.resultCount$</eval>
        </progress>
      </search>

      <chart>
        <title>Top sourcetypes for index=_internal</title>
        <search base="search_logic" />
        <option name="charting.chart">bar</option>
      </chart>
      <html>
          <h3>Scancount : $scancount$</h3>
          <h3>resultcount : $resultcount$</h3>
      </html>
    </panel>
  </row>
</dashboard>

somesoni2 · ‎01-09-2017

I don't believe there is a search command provides all those properties. However, in Splunk 6.3+ onwards, the panel <search> element provides event handler which exposes those job properties. So, you can use event handle which have access to job properties (<progress> and <done>), then you can use a eval/set option to get those job properties to a token that can be used to display the same elsewhere (not in the search result, but to a label/title/html).

http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/EventHandlerReference#Search_event_handlers
http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/tokens#Search_event_elements_and_job_propertie...

Which search commands allow you to display search property values in a table or dashboard?

Splunk Enterprise Security 8.0.2 Availability: On cloud and On-premise!

Logs to Metrics

Developer Spotlight with Paul Stout