Knowledge Management

How do i display the total number of unique records per row? See the attached image.

ronniemakhombi
Explorer

I want to print the total on the statistics tab.

Tags (1)
0 Karma

niketn
Legend

Try the following run anywhere example. You can use <progress> or <done> search event handler depending on your use case to capture the number of results returned by a search using a predefined token $job.resultCount$

<dashboard>
  <label>Table Result Count</label>
  <row>
    <panel>
      <title>My Search (Results: $tokResultCount$)</title>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd
| stats count by component           
          </query>
          <earliest>-1h@h</earliest>
          <latest>now</latest>
          <progress>
            <set token="tokResultCount">$job.resultCount$</set>
          </progress>
        </search>
      </table>
    </panel>
  </row>
</dashboard>

Refer to documentation: https://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Search_event_elements_and_job_propert...

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

@ronniemakhombi the expected output is still not clear. For the community to assist you better please add further details as to which value is the total and where is it going to be displayed. Also whether this request is for Dashboard or not?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

ronniemakhombi
Explorer

Thank you for your comment, I want to display the total number of events/records. for example in the snippet attached, there are five records (5). Is there a way i can print this out or display this number.

0 Karma

p_gurav
Champion

Do you want total of ACC_NBR column?

0 Karma

ronniemakhombi
Explorer

Thank you for your comment, I want to display the total number of events/records. for example in the snippet attached, there are five records (5). Is there a way i can print this out or display this number.

0 Karma

p_gurav
Champion

Can you try :
| stats count by ACC_NBR

0 Karma

harishalipaka
Motivator

@ronniemakhombi
you can go with my code|dedup ACC_NBR |stats count

Thanks
Harish
0 Karma

ronniemakhombi
Explorer

No, I want to print or display 86 513 for reporting

0 Karma

harishalipaka
Motivator

@ronniemakhmbi

add end of your query like this

|dedup ACC_NBR  |stats count
Thanks
Harish
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...