Dashboards & Visualizations

In a dashboard panel, how would I get the result count to show (with paging)?

the_wolverine
Champion

I have a table displayed in a dashboard panel with pagination enabled. I don't see any way to get the results count to display.

0 Karma

sideview
SplunkTrust
SplunkTrust

If this is the Simple XML, there does not seem to be any way, at least not in a dashboard panel.

If you're using the Advanced XML, but still just with core Splunk modules, the you would use either the ResultsHeader module, which would look like this

<module name="ResultsHeader">
  <param name="entityLabel">results</param>
  <param name="entityLabelSingular">result</param>
  <param name="entityName">results</param>
</module>

Or you would use the SimpleResultsHeader module, which has a special (%(count)s) syntax for embedding the number of results into the custom header text.

<module name="SimpleResultsHeader">
  <param name="entityName">results</param>
  <param name="headerFormat">Sources (%(count)s)</param>
</module>

and if you're using Sideview Utils it's a relatively simple matter of using $results.count$ anywhere in the HTML module. I also used the $search.timeRange.label$ key in this example, which will print out things like "in the last 24 hours" or "during January 2013" as appropriate to match the timerange used.

<module name="HTML">
  <param name="html"><![CDATA[
    <h3>$results.count$ results found $search.timeRange.label$</h3>
  ]]></param>
</module>

sideview
SplunkTrust
SplunkTrust

Oh. If you have to account for postprocess it's a little different.

What you do is this:

<module name="PostProcess">
  <param name="search"> your postprocess here</param>
  <module name="PostProcess">
    <param name="search">$postProcess$ | stats count</param>
    <module name="HTML">
      <param name="html">$results[0].count$ plus whatever html tags</param>
    </module>
    <module name="Pager">
      <module name="Table"/>
    </module>
  </module>
</module>
0 Karma

0waste_splunk
Communicator

i have 3 panel. it will show $results.count$ all the same. but i know all the panel has different number of rows in the result. how can i show different and correct total row count for each panel.
FYI: i am using sideview utils
i have panel like this:
HTML->PostProcess->Pager->SimpleResultsTable
for all three panel.

0 Karma
Get Updates on the Splunk Community!

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...