- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- mvcombine count all elements of the field
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
mvcombine count all elements of the field
I have a list of 5 elements:
After i use mvcombine i return only 1 result, but i have effectively 5 elements.
The $job.resultCount$ return 1, how to return 5?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Included in the Dashboard Examples app you may have noticed a token debugger tool. This is available as a separate widget that you can add to any dashboard in the Developer Gadgets app that will help a great deal debugging your problem: https://splunkbase.splunk.com/app/3689/
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
edit: while this does work, I also tested @woodcock 's solution and it works and is much better than mine
Copy and paste this into a new dashboard. I think it has everything you need. I separated your search into a base search where one search returns the true count and the other returns the data you want. The token is then set from the count search instead of the result search.
<dashboard>
<label>Test Dashboard</label>
<search id="baseSearch">
<query>| makeresults count=5
| eval Type="Product", ID=random()</query>
<earliest>-24h@m</earliest>
<latest>now</latest>
</search>
<search base="baseSearch" id="countSearch">
<query>stats count</query>
<done>
<set token="resultCount">$result.count$</set>
</done>
</search>
<row>
<html>
resultCount: $resultCount$
</html>
</row>
<row>
<panel>
<table>
<search base="baseSearch">
<query>stats delim="; " list(ID) as ID by Type
| mvcombine ID</query>
</search>
</table>
</panel>
</row>
</dashboard>
Jacob
If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this:
| makeresults count=5
| eval TYPE="Protect", ID=random()
| table ID TYPE
| stats delim="; " count(ID) AS _count list(ID) AS ID BY TYPE
| mvcombine ID
This makes the _count field invisible to the user but available with $result._count$.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The token doesn't work, what is wrong?
<dashboard>
<label>TEST_RESULTCOUNT</label>
<row>
<panel>
<title>TOTALE:$totale$</title>
<table>
<search>
<query>| makeresults count=5
| eval TYPE="Protect", ID=random()
| table ID TYPE
| stats delim="; " count(ID) as _count list(ID) as ID by TYPE
| mvcombine ID</query>
<earliest>0</earliest>
<latest></latest>
<sampleRatio>1</sampleRatio>
<done>
<condition>
<set token="totale">$result._count$</set>
</condition>
</done>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
</dashboard>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I don't get it, I do this all the time. Install the Dashboard Examples app and check out the drilldown examples. Maybe your version has a bug?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I don't known, i use 7.3.0 enterprise so i try to install Dashboard Examples
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Today I upgraded splunk to 7.3.1 but the $result._count$ still doesn't work.
I have seen all the examples but any helped me to find the solution.
I tried | eval count = _count to see if the count return a result, it works!.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try adding "count" to your stats function e.g.
| makeresults count=5
| eval Type="Product", ID=random()
| table ID, Type
| stats delim="; " list(ID) as ID *count* by Type
| mvcombine ID
then change $job.resultCount$ to $result.count$
If you still want the total count (if there are multiple Types), do the count before the list e.g.
| makeresults count=5
| eval Type="Product", ID=random()
| table ID, Type
| stats *count*
| stats delim="; " list(ID) as ID by Type count
| mvcombine ID
Jacob
If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The first answer work only if the column count is visible.
I tried with | field - count or | table Type ID but $result.count$ doesn't work.
While the second answer no result found
Index This | Divide 100 by half. What do you get?
Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!
Splunk and Fraud
