Splunk Search

Which search commands allow you to display search property values in a table or dashboard?

kplatte
New Member

Which search commands allow you to display search property values in a table or dashboard? I am referring specifically to scanCount and resultCount . How can I add resultCount, scanCount to a table?

Thanks in advance!
Kyle

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@kplatte - Looks like you have a few possible solutions to your question. If one of them provided a working solution, please don't forget to click "Accept" below the best answer to resolve this post. If you still need help, please leave a comment. Don’t forget to upvote anything that was helpful too. Thanks!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi kplatte,
if you want to add to your table a column with the total count of events you could run something like this:

index=_internal | eventstats count AS cnt | stats values(cnt) AS cnt count by host 

if instead you want to have the number of events outside the panel (e.g. in the Panel's Title), you have to insert in your search something like this:

<progress>
   <eval token="scancount">$job.scanCount$</eval>
   <eval token="resultcount">$job.resultCount$</eval>
</progress>

and use the token.

Bye.
Giuseppe

0 Karma

Lucas_K
Motivator

Here ya go example code at the bottom.

Explanation.
Create an eval via a progress tag.
Then insert that new eval somewhere on your dashboard.

Any of the job tokens can be grabbed in the same manner.

<dashboard>
  <label>Token Example</label>
  <row>
    <panel>
      <search id="search_logic">
        <query>index=_internal  sourcetype=splunkd|  top sourcetype</query>
                  <earliest>-1m</earliest>
          <latest>now</latest>

        <progress>
          <eval token="scancount">$job.scanCount$</eval>
          <eval token="resultcount">$job.resultCount$</eval>
        </progress>
      </search>

      <chart>
        <title>Top sourcetypes for index=_internal</title>
        <search base="search_logic" />
        <option name="charting.chart">bar</option>
      </chart>
      <html>
          <h3>Scancount : $scancount$</h3>
          <h3>resultcount : $resultcount$</h3>
      </html>
    </panel>
  </row>
</dashboard>
0 Karma

somesoni2
Revered Legend

I don't believe there is a search command provides all those properties. However, in Splunk 6.3+ onwards, the panel <search> element provides event handler which exposes those job properties. So, you can use event handle which have access to job properties (<progress> and <done>), then you can use a eval/set option to get those job properties to a token that can be used to display the same elsewhere (not in the search result, but to a label/title/html).

http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/EventHandlerReference#Search_event_handlers
http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/tokens#Search_event_elements_and_job_propertie...

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...