Splunk Search

How do you show a row count in a dashboard panel?

edwardrose
Contributor

Hello All

I am not sure how to show the row count in my dashboard.

I have one panel that searches a list of hosts for data and displays the indexes and source types. I have a second panel that shows hosts that are not reporting into Splunk and I would like to have the count listed at the top of the panel.

I did try to follow some instructions from others on answers.splunk.com, but the XML keeps giving me errors. Can someone please help me get it right?

thanks
ed

<form>
  <label>DMZ Host Data</label>
  <description>List of all DMZ Hosts and the data collected</description>
  <fieldset autoRun="false">
    <input type="dropdown" token="hostname">
      <label>Host Name</label>
      <fieldForLabel>hostname</fieldForLabel>
      <fieldForValue>hostname</fieldForValue>
      <search>
        <query>| inputlookup dmzhosts.csv 
| dedup hostname 
| search NOT hostname=*vip*
| sort hostname</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <initialValue>*</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>All Indexes associated with Host</title>
      <table>
        <title>Indexes</title>
        <search>
          <query>index=* host=$hostname$* |stats values(index) as index values(sourcetype) as sourcetype values(source) as source</query>
          <earliest>-7d@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>Missing DMZ Hosts</title>
      <table>
        <title>List of hosts in the DMZ that are not reporting in total</title>
        <search>
          <query>| inputlookup missing_dmzhosts.csv 
| search NOT host=*VIP*
| lookup dnslookup clienthost as host OUTPUT clientip as IP 
| join type=outer IP 
    [ inputlookup gennery_espinoza_assets.csv] 
| table host, IP, Director</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>
Tags (4)
0 Karma
1 Solution

493669
Super Champion

Try this:

<panel>
       <title>Missing DMZ Hosts</title>
       <table>
         <title>List of hosts in the DMZ that are not reporting in total $count$</title>
         <search>
           <query>| inputlookup missing_dmzhosts.csv 
 | search NOT host=*VIP*
 | lookup dnslookup clienthost as host OUTPUT clientip as IP 
 | join type=outer IP 
     [ inputlookup gennery_espinoza_assets.csv] 
 | table host, IP, Director</query>
           <earliest>-24h@h</earliest>
           <latest>now</latest>
           <progress>
                <set token="count">$job.resultCount$</set>
          </progress>
         </search>
         <option name="drilldown">none</option>
         <option name="refresh.display">progressbar</option>
       </table>
     </panel>

Here created token name-count and saved query result count in it.

View solution in original post

0 Karma

493669
Super Champion

Try this:

<panel>
       <title>Missing DMZ Hosts</title>
       <table>
         <title>List of hosts in the DMZ that are not reporting in total $count$</title>
         <search>
           <query>| inputlookup missing_dmzhosts.csv 
 | search NOT host=*VIP*
 | lookup dnslookup clienthost as host OUTPUT clientip as IP 
 | join type=outer IP 
     [ inputlookup gennery_espinoza_assets.csv] 
 | table host, IP, Director</query>
           <earliest>-24h@h</earliest>
           <latest>now</latest>
           <progress>
                <set token="count">$job.resultCount$</set>
          </progress>
         </search>
         <option name="drilldown">none</option>
         <option name="refresh.display">progressbar</option>
       </table>
     </panel>

Here created token name-count and saved query result count in it.

0 Karma

edwardrose
Contributor

That works awesome. Thanks a lot

-ed

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...