mvcombine count all elements of the field

splunk6161 · ‎07-29-2019

I have a list of 5 elements:

After i use mvcombine i return only 1 result, but i have effectively 5 elements.

The $job.resultCount$ return 1, how to return 5?

woodcock · ‎08-01-2019

Included in the Dashboard Examples app you may have noticed a token debugger tool. This is available as a separate widget that you can add to any dashboard in the Developer Gadgets app that will help a great deal debugging your problem: https://splunkbase.splunk.com/app/3689/

jacobpevans · ‎07-29-2019

edit: while this does work, I also tested @woodcock 's solution and it works and is much better than mine

Copy and paste this into a new dashboard. I think it has everything you need. I separated your search into a base search where one search returns the true count and the other returns the data you want. The token is then set from the count search instead of the result search.

<dashboard>
  <label>Test Dashboard</label>
  <search id="baseSearch">
    <query>| makeresults count=5 
| eval Type="Product", ID=random()</query>
    <earliest>-24h@m</earliest>
    <latest>now</latest>
  </search>
  <search base="baseSearch" id="countSearch">
    <query>stats count</query>
    <done>
     <set token="resultCount">$result.count$</set>
    </done>
  </search>
  <row>
    <html>
      resultCount: $resultCount$
    </html>
  </row>
  <row>
    <panel>
      <table>
        <search base="baseSearch">
          <query>stats delim="; " list(ID) as ID by Type 
| mvcombine ID</query>
        </search>
      </table>
    </panel>
  </row>
</dashboard>

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.

woodcock · ‎07-29-2019

Try this:

| makeresults count=5 
| eval TYPE="Protect", ID=random() 
| table ID TYPE 
| stats delim="; " count(ID) AS _count list(ID) AS ID BY TYPE 
| mvcombine ID

This makes the _count field invisible to the user but available with $result._count$ .

splunk6161 · ‎07-30-2019

The token doesn't work, what is wrong?

<dashboard>
  <label>TEST_RESULTCOUNT</label>
  <row>
    <panel>
      <title>TOTALE:$totale$</title>
      <table>
        <search>
          <query>| makeresults count=5
| eval TYPE="Protect", ID=random()
| table ID TYPE
| stats delim="; " count(ID) as _count list(ID) as ID by TYPE 
| mvcombine ID</query>
          <earliest>0</earliest>
          <latest></latest>
          <sampleRatio>1</sampleRatio>
          <done>
            <condition>
              <set token="totale">$result._count$</set>
            </condition>
          </done>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</dashboard>

woodcock · ‎07-30-2019

I don't get it, I do this all the time. Install the Dashboard Examples app and check out the drilldown examples. Maybe your version has a bug?

splunk6161 · ‎07-31-2019

I don't known, i use 7.3.0 enterprise so i try to install Dashboard Examples

splunk6161 · ‎08-01-2019

Today I upgraded splunk to 7.3.1 but the $result._count$ still doesn't work.
I have seen all the examples but any helped me to find the solution.
I tried | eval count = _count to see if the count return a result, it works!.

jacobpevans · ‎07-29-2019

Try adding "count" to your stats function e.g.

| makeresults count=5
| eval Type="Product", ID=random()
| table ID, Type
| stats delim="; " list(ID) as ID *count* by Type
| mvcombine ID

then change $job.resultCount$ to $result.count$

If you still want the total count (if there are multiple Types), do the count before the list e.g.

| makeresults count=5
| eval Type="Product", ID=random()
| table ID, Type
| stats *count*
| stats delim="; " list(ID) as ID by Type count
| mvcombine ID

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.

splunk6161 · ‎07-29-2019

The first answer work only if the column count is visible.
I tried with | field - count or | table Type ID but $result.count$ doesn't work.
While the second answer no result found

mvcombine count all elements of the field

Welcome to the Splunk Community!

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Adoption of RUM and APM at Splunk