Dashboards & Visualizations

simple XML Results Panel : table : Display count of results

hartfoml
Motivator

I have a form dashboard that return results in a table format with potently more than 10,000 rows.

I have been asked if i can show the total number of results at the top of the table

I have this results view


<panel>
<title>Hardware Lookup</title>
<table>
<title>Matching events</title>
<option name="count">10</option>
</table>
</panel>

I found this answer by @sideview
In a dashboard panel, how would I get the result count to show (with paging)?
I just could not find where to put this code in the HTML to make it work

What option can I use or what module to show the total count of rows returned for the form search?
Oh an were in the HTML would I put the module. I know where to put the option.

Tags (2)

lakromani
Builder

Some old question, but here is a way to do it with an example.

I do calculate the number of rows in an input dopdown box.
Then set the output of it as default to the variable.
The input is then hidden with depends="$hidden$"

This should work for all as it counts the indexes used from _internal

<form>
  <label>Test hit counter in title</label>
  <fieldset autoRun="true" submitButton="false">
    <input type="time" token="global_time" searchWhenChanged="true">
      <label>Time frame</label>
      <default>Last 24 hours</default>
    </input>
    <input depends="$hidden$" type="dropdown" token="Counter" searchWhenChanged="true">
      <label>Counter</label>
      <!--<choice value="foo">Foo</choice>-->
      <search>
        <query>index=_internal
          | top limit=20 sourcetype
          | stats count</query>
        <earliest>$global_time.earliest$</earliest>
        <latest>$global_time.latest$</latest>
      </search>
      <fieldForLabel>count</fieldForLabel>
      <fieldForValue>count</fieldForValue>
      <selectFirstChoice>true</selectFirstChoice>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Number of indexes: $Counter$</title>
      <chart>
        <search>
          <query>index=_internal 
            | top limit=20 sourcetype</query>
          <earliest>$global_time.earliest$</earliest>
          <latest>$global_time.latest$</latest>
        </search>
        <option name="charting.chart">bar</option>
      </chart>
    </panel>
  </row>
</form>
0 Karma

cblanton
Communicator

this is kind of brilliant! there had to be a way. @hartfoml you should accept this answer. thank you @lakromani!

0 Karma

woodcock
Esteemed Legend

You can just add this to your search to put it to the side (I know that isn't the same as on top):

appendpipe [|stats count]
0 Karma

lguinn2
Legend

What is your search? Perhaps what you want can be accomplished by changing your search instead of changing the dashboard.

0 Karma

hartfoml
Motivator

I am using the dbquery to look for rows in a database table.

When I run the search in the search app i can see the number of rows returned.

When I use the Forms dashboard for my users I can not see the number of rows returned.

Can I use the form dashboard to do two query's one to do Select count(*) and one to do select *
then present the data under the count of the rows returned?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The answer you cite applies to advanced XML, not simple XML.

---
If this reply helps you, Karma would be appreciated.
0 Karma

hartfoml
Motivator

Thanks @richgalloway for the help, I think the answer from other posts " this is not possible in simple xml. I really was hoping that I didn't have to put in a feature request.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...