If this is the Simple XML, there does not seem to be any way, at least not in a dashboard panel.
If you're using the Advanced XML, but still just with core Splunk modules, the you would use either the ResultsHeader
module, which would look like this
<module name="ResultsHeader">
<param name="entityLabel">results</param>
<param name="entityLabelSingular">result</param>
<param name="entityName">results</param>
</module>
Or you would use the SimpleResultsHeader
module, which has a special (%(count)s)
syntax for embedding the number of results into the custom header text.
<module name="SimpleResultsHeader">
<param name="entityName">results</param>
<param name="headerFormat">Sources (%(count)s)</param>
</module>
and if you're using Sideview Utils it's a relatively simple matter of using $results.count$ anywhere in the HTML module. I also used the $search.timeRange.label$ key in this example, which will print out things like "in the last 24 hours" or "during January 2013" as appropriate to match the timerange used.
<module name="HTML">
<param name="html"><![CDATA[
<h3>$results.count$ results found $search.timeRange.label$</h3>
]]></param>
</module>
Oh. If you have to account for postprocess it's a little different.
What you do is this:
<module name="PostProcess">
<param name="search"> your postprocess here</param>
<module name="PostProcess">
<param name="search">$postProcess$ | stats count</param>
<module name="HTML">
<param name="html">$results[0].count$ plus whatever html tags</param>
</module>
<module name="Pager">
<module name="Table"/>
</module>
</module>
</module>
i have 3 panel. it will show $results.count$ all the same. but i know all the panel has different number of rows in the result. how can i show different and correct total row count for each panel.
FYI: i am using sideview utils
i have panel like this:
HTML->PostProcess->Pager->SimpleResultsTable
for all three panel.