Splunk Search
Highlighted

mvcombine count all elements of the field

Path Finder

I have a list of 5 elements:
alt text

After i use mvcombine i return only 1 result, but i have effectively 5 elements.
alt text

The $job.resultCount$ return 1, how to return 5?

0 Karma
Highlighted

Re: mvcombine count all elements of the field

Motivator

Try adding "count" to your stats function e.g.

| makeresults count=5
| eval Type="Product", ID=random()
| table ID, Type
| stats delim="; " list(ID) as ID *count* by Type
| mvcombine ID

then change $job.resultCount$ to $result.count$

If you still want the total count (if there are multiple Types), do the count before the list e.g.

| makeresults count=5
| eval Type="Product", ID=random()
| table ID, Type
| stats *count*
| stats delim="; " list(ID) as ID by Type count
| mvcombine ID
Cheers,
Jacob
0 Karma
Highlighted

Re: mvcombine count all elements of the field

Path Finder

The first answer work only if the column count is visible.
I tried with | field - count or | table Type ID but $result.count$ doesn't work.
While the second answer no result found

0 Karma
Highlighted

Re: mvcombine count all elements of the field

Esteemed Legend

Try this:

| makeresults count=5 
| eval TYPE="Protect", ID=random() 
| table ID TYPE 
| stats delim="; " count(ID) AS _count list(ID) AS ID BY TYPE 
| mvcombine ID

This makes the _count field invisible to the user but available with $result._count$.

Highlighted

Re: mvcombine count all elements of the field

Path Finder

The token doesn't work, what is wrong?

<dashboard>
  <label>TEST_RESULTCOUNT</label>
  <row>
    <panel>
      <title>TOTALE:$totale$</title>
      <table>
        <search>
          <query>| makeresults count=5
| eval TYPE="Protect", ID=random()
| table ID TYPE
| stats delim="; " count(ID) as _count list(ID) as ID by TYPE 
| mvcombine ID</query>
          <earliest>0</earliest>
          <latest></latest>
          <sampleRatio>1</sampleRatio>
          <done>
            <condition>
              <set token="totale">$result._count$</set>
            </condition>
          </done>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</dashboard>
0 Karma
Highlighted

Re: mvcombine count all elements of the field

Esteemed Legend

I don't get it, I do this all the time. Install the Dashboard Examples app and check out the drilldown examples. Maybe your version has a bug?

Highlighted

Re: mvcombine count all elements of the field

Path Finder

I don't known, i use 7.3.0 enterprise so i try to install Dashboard Examples

0 Karma
Highlighted

Re: mvcombine count all elements of the field

Path Finder

Today I upgraded splunk to 7.3.1 but the $result._count$ still doesn't work.
I have seen all the examples but any helped me to find the solution.
I tried | eval count = _count to see if the count return a result, it works!.

0 Karma
Highlighted

Re: mvcombine count all elements of the field

Motivator

edit: while this does work, I also tested @woodcock 's solution and it works and is much better than mine

Copy and paste this into a new dashboard. I think it has everything you need. I separated your search into a base search where one search returns the true count and the other returns the data you want. The token is then set from the count search instead of the result search.

<dashboard>
  <label>Test Dashboard</label>
  <search id="baseSearch">
    <query>| makeresults count=5 
| eval Type="Product", ID=random()</query>
    <earliest>-24h@m</earliest>
    <latest>now</latest>
  </search>
  <search base="baseSearch" id="countSearch">
    <query>stats count</query>
    <done>
     <set token="resultCount">$result.count$</set>
    </done>
  </search>
  <row>
    <html>
      resultCount: $resultCount$
    </html>
  </row>
  <row>
    <panel>
      <table>
        <search base="baseSearch">
          <query>stats delim="; " list(ID) as ID by Type 
| mvcombine ID</query>
        </search>
      </table>
    </panel>
  </row>
</dashboard>
Cheers,
Jacob
0 Karma
Highlighted

Re: mvcombine count all elements of the field

Esteemed Legend

Included in the Dashboard Examples app you may have noticed a token debugger tool. This is available as a separate widget that you can add to any dashboard in the Developer Gadgets app that will help a great deal debugging your problem: https://splunkbase.splunk.com/app/3689/

0 Karma