
Why does $job.resultCount$ not display on a dashboard as a token, but will if I assign it to another token?
When a search finishes, $job.resultCount$ holds the total rows/events returned.
If I assign that in a <done>...</done> clause thusly, I can display it on the dashboard using the token name assigned in the <done>...:
<done> <set token="counttoken">$job.resultCount$</set> </done>
In a <title> tag, I can then reference the new eval'd token, and it'll sub-in the value:
<title>Total Returned Results - $counttoken$</title>
But if I put the "raw" token on the dashboard, I don't see anything but the literal text of "$job.resultCount$":
<title>Total Returned Results - $job.resultCount$</title>
What may be causing this behavior?
Splunk 8.0.4.1, if the version matters
Submitted June 25, 2020 at 05:44PM
via reddit https://www.reddit.com/r/Splunk/comments/hfuvh3/why_does_jobresultcount_not_display_on_a/?utm_source=ifttt