Splunk Search

mvcombine count all elements of the field

splunk6161
Path Finder

I have a list of 5 elements:
alt text

After i use mvcombine i return only 1 result, but i have effectively 5 elements.
alt text

The $job.resultCount$ return 1, how to return 5?

0 Karma

woodcock
Esteemed Legend

Included in the Dashboard Examples app you may have noticed a token debugger tool. This is available as a separate widget that you can add to any dashboard in the Developer Gadgets app that will help a great deal debugging your problem: https://splunkbase.splunk.com/app/3689/

0 Karma

jacobpevans
Motivator

edit: while this does work, I also tested @woodcock 's solution and it works and is much better than mine

Copy and paste this into a new dashboard. I think it has everything you need. I separated your search into a base search where one search returns the true count and the other returns the data you want. The token is then set from the count search instead of the result search.

<dashboard>
  <label>Test Dashboard</label>
  <search id="baseSearch">
    <query>| makeresults count=5 
| eval Type="Product", ID=random()</query>
    <earliest>-24h@m</earliest>
    <latest>now</latest>
  </search>
  <search base="baseSearch" id="countSearch">
    <query>stats count</query>
    <done>
     <set token="resultCount">$result.count$</set>
    </done>
  </search>
  <row>
    <html>
      resultCount: $resultCount$
    </html>
  </row>
  <row>
    <panel>
      <table>
        <search base="baseSearch">
          <query>stats delim="; " list(ID) as ID by Type 
| mvcombine ID</query>
        </search>
      </table>
    </panel>
  </row>
</dashboard>
Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma

woodcock
Esteemed Legend

Try this:

| makeresults count=5 
| eval TYPE="Protect", ID=random() 
| table ID TYPE 
| stats delim="; " count(ID) AS _count list(ID) AS ID BY TYPE 
| mvcombine ID

This makes the _count field invisible to the user but available with $result._count$.

splunk6161
Path Finder

The token doesn't work, what is wrong?

<dashboard>
  <label>TEST_RESULTCOUNT</label>
  <row>
    <panel>
      <title>TOTALE:$totale$</title>
      <table>
        <search>
          <query>| makeresults count=5
| eval TYPE="Protect", ID=random()
| table ID TYPE
| stats delim="; " count(ID) as _count list(ID) as ID by TYPE 
| mvcombine ID</query>
          <earliest>0</earliest>
          <latest></latest>
          <sampleRatio>1</sampleRatio>
          <done>
            <condition>
              <set token="totale">$result._count$</set>
            </condition>
          </done>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</dashboard>
0 Karma

woodcock
Esteemed Legend

I don't get it, I do this all the time. Install the Dashboard Examples app and check out the drilldown examples. Maybe your version has a bug?

splunk6161
Path Finder

I don't known, i use 7.3.0 enterprise so i try to install Dashboard Examples

0 Karma

splunk6161
Path Finder

Today I upgraded splunk to 7.3.1 but the $result._count$ still doesn't work.
I have seen all the examples but any helped me to find the solution.
I tried | eval count = _count to see if the count return a result, it works!.

0 Karma

jacobpevans
Motivator

Try adding "count" to your stats function e.g.

| makeresults count=5
| eval Type="Product", ID=random()
| table ID, Type
| stats delim="; " list(ID) as ID *count* by Type
| mvcombine ID

then change $job.resultCount$ to $result.count$

If you still want the total count (if there are multiple Types), do the count before the list e.g.

| makeresults count=5
| eval Type="Product", ID=random()
| table ID, Type
| stats *count*
| stats delim="; " list(ID) as ID by Type count
| mvcombine ID
Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma

splunk6161
Path Finder

The first answer work only if the column count is visible.
I tried with | field - count or | table Type ID but $result.count$ doesn't work.
While the second answer no result found

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!