I'm trying to create a single value panel that shows the total count of results in panels on the dashboard. So say if Panel number 3 , 5 and 8 on the dashboard are showing results the single value panel at the top would say 3.
Thanks for any help!
@mcg_connor ,
You may try with search event tokens.
Here is a run anywhere example
In case you want to show the total count of the results, you may set the token to $job.resultCount$
<dashboard>
<label>Single Panal Values</label>
<row>
<panel>
<table>
<search>
<query>index=_internal |stats count by sourcetype</query>
<earliest>-15m</earliest>
<latest>now</latest>
<done>
<condition match="'job.resultCount' > 0">
<set token="first_panel_count">1</set>
</condition>
<condition>
<set token="first_panel_count">0</set>
</condition>
</done>
</search>
<option name="drilldown">none</option>
</table>
</panel>
<panel>
<table>
<search>
<query>index=_audit |stats count by sourcetype</query>
<earliest>-15m</earliest>
<latest>now</latest>
<done>
<condition match="'job.resultCount' > 0">
<set token="second_panel_count">1</set>
</condition>
<condition>
<set token="second_panel_count">0</set>
</condition>
</done>
</search>
<option name="drilldown">none</option>
</table>
</panel>
<panel>
<table>
<search>
<query>index=_introspection |stats count by sourcetype</query>
<earliest>-15m</earliest>
<latest>now</latest>
<done>
<condition match="'job.resultCount' > 0">
<set token="third_panel_count">1</set>
</condition>
<condition>
<set token="third_panel_count">0</set>
</condition>
</done>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
<row>
<panel>
<single>
<search>
<query>|makeresults|eval result=$first_panel_count$+$second_panel_count$+$third_panel_count$</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
</single>
</panel>
</row>
</dashboard>
Set a default value for panel_count
of 0
then put a done
clause in each panel with this in it <eval token="panel_count">$panel_count$ + 1</eval>
.
@mcg_connor ,
You may try with search event tokens.
Here is a run anywhere example
In case you want to show the total count of the results, you may set the token to $job.resultCount$
<dashboard>
<label>Single Panal Values</label>
<row>
<panel>
<table>
<search>
<query>index=_internal |stats count by sourcetype</query>
<earliest>-15m</earliest>
<latest>now</latest>
<done>
<condition match="'job.resultCount' > 0">
<set token="first_panel_count">1</set>
</condition>
<condition>
<set token="first_panel_count">0</set>
</condition>
</done>
</search>
<option name="drilldown">none</option>
</table>
</panel>
<panel>
<table>
<search>
<query>index=_audit |stats count by sourcetype</query>
<earliest>-15m</earliest>
<latest>now</latest>
<done>
<condition match="'job.resultCount' > 0">
<set token="second_panel_count">1</set>
</condition>
<condition>
<set token="second_panel_count">0</set>
</condition>
</done>
</search>
<option name="drilldown">none</option>
</table>
</panel>
<panel>
<table>
<search>
<query>index=_introspection |stats count by sourcetype</query>
<earliest>-15m</earliest>
<latest>now</latest>
<done>
<condition match="'job.resultCount' > 0">
<set token="third_panel_count">1</set>
</condition>
<condition>
<set token="third_panel_count">0</set>
</condition>
</done>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
<row>
<panel>
<single>
<search>
<query>|makeresults|eval result=$first_panel_count$+$second_panel_count$+$third_panel_count$</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
</single>
</panel>
</row>
</dashboard>