Dashboards & Visualizations

Pass Count from Multiple Panels to a Single Value Panel

mcg_connor
Path Finder

I'm trying to create a single value panel that shows the total count of results in panels on the dashboard. So say if Panel number 3 , 5 and 8 on the dashboard are showing results the single value panel at the top would say 3.

Thanks for any help!

0 Karma
1 Solution

renjith_nair
Legend

@mcg_connor ,

You may try with search event tokens.

Here is a run anywhere example

  • Check each panels result count and if it's greater than 0 set the respective token to 1 , otherwise 0
  • Run a dummy search and add(+) these token values for the single value panel
  • In case you want to show the total count of the results, you may set the token to $job.resultCount$

    <dashboard>
      <label>Single Panal Values</label>
      <row>
        <panel>
          <table>
            <search>
              <query>index=_internal |stats count by sourcetype</query>
              <earliest>-15m</earliest>
              <latest>now</latest>
              <done>
                <condition match="'job.resultCount' > 0">
                  <set token="first_panel_count">1</set>
                </condition>
                <condition>
                  <set token="first_panel_count">0</set>
                </condition>
              </done>
            </search>
            <option name="drilldown">none</option>
          </table>
        </panel>
        <panel>
          <table>
            <search>
              <query>index=_audit |stats count by sourcetype</query>
              <earliest>-15m</earliest>
              <latest>now</latest>
              <done>
                <condition match="'job.resultCount' > 0">
                  <set token="second_panel_count">1</set>
                </condition>
                <condition>
                  <set token="second_panel_count">0</set>
                </condition>
              </done>
            </search>
            <option name="drilldown">none</option>
          </table>
        </panel>
        <panel>
          <table>
            <search>
              <query>index=_introspection |stats count by sourcetype</query>
              <earliest>-15m</earliest>
              <latest>now</latest>
              <done>
                <condition match="'job.resultCount' > 0">
                  <set token="third_panel_count">1</set>
                </condition>
                <condition>
                  <set token="third_panel_count">0</set>
                </condition>
              </done>
            </search>
            <option name="drilldown">none</option>
          </table>
        </panel>
      </row>
      <row>
        <panel>
          <single>
            <search>
              <query>|makeresults|eval result=$first_panel_count$+$second_panel_count$+$third_panel_count$</query>
              <earliest>-15m</earliest>
              <latest>now</latest>
            </search>
            <option name="drilldown">none</option>
          </single>
        </panel>
      </row>
    </dashboard>
    
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

woodcock
Esteemed Legend

Set a default value for panel_count of 0
then put a done clause in each panel with this in it <eval token="panel_count">$panel_count$ + 1</eval>.

0 Karma

renjith_nair
Legend

@mcg_connor ,

You may try with search event tokens.

Here is a run anywhere example

  • Check each panels result count and if it's greater than 0 set the respective token to 1 , otherwise 0
  • Run a dummy search and add(+) these token values for the single value panel
  • In case you want to show the total count of the results, you may set the token to $job.resultCount$

    <dashboard>
      <label>Single Panal Values</label>
      <row>
        <panel>
          <table>
            <search>
              <query>index=_internal |stats count by sourcetype</query>
              <earliest>-15m</earliest>
              <latest>now</latest>
              <done>
                <condition match="'job.resultCount' > 0">
                  <set token="first_panel_count">1</set>
                </condition>
                <condition>
                  <set token="first_panel_count">0</set>
                </condition>
              </done>
            </search>
            <option name="drilldown">none</option>
          </table>
        </panel>
        <panel>
          <table>
            <search>
              <query>index=_audit |stats count by sourcetype</query>
              <earliest>-15m</earliest>
              <latest>now</latest>
              <done>
                <condition match="'job.resultCount' > 0">
                  <set token="second_panel_count">1</set>
                </condition>
                <condition>
                  <set token="second_panel_count">0</set>
                </condition>
              </done>
            </search>
            <option name="drilldown">none</option>
          </table>
        </panel>
        <panel>
          <table>
            <search>
              <query>index=_introspection |stats count by sourcetype</query>
              <earliest>-15m</earliest>
              <latest>now</latest>
              <done>
                <condition match="'job.resultCount' > 0">
                  <set token="third_panel_count">1</set>
                </condition>
                <condition>
                  <set token="third_panel_count">0</set>
                </condition>
              </done>
            </search>
            <option name="drilldown">none</option>
          </table>
        </panel>
      </row>
      <row>
        <panel>
          <single>
            <search>
              <query>|makeresults|eval result=$first_panel_count$+$second_panel_count$+$third_panel_count$</query>
              <earliest>-15m</earliest>
              <latest>now</latest>
            </search>
            <option name="drilldown">none</option>
          </single>
        </panel>
      </row>
    </dashboard>
    
---
What goes around comes around. If it helps, hit it with Karma 🙂
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...