topic Re: Is it possible to display the cleaner version of raw data in a table or event panel in Dashboards & Visualizations

Is it possible to display the cleaner version of raw data in a table or event panel

brooklynotss — Thu, 28 Jan 2016 21:29:41 GMT

I'm not sure what this part of the raw data UI view is called. See screen shot,

Ideally i'm looking to, on loading of the dashboard panel, only display the data as it looks in section 3 (only the Field and Value parts - don't need or want that Actions dropdown column). Section is 2 what you get out of the box, section 3 only appears if you click the toggle next to my number 1. Also ideally looking to do this in Simple XML. Any help appreciated.

Bigger picture is a dashboard that is a single reference for all data about the selected endpoint so I want to display the PC systeminfo like you see here, but also pull in a whole bunch of other data points. So it's a lot of text to display on a page and just looking to make it as clean as possible. I suspect I need to get into HTML for this but wanted to try here first.

Re: Is it possible to display the cleaner version of raw data in a table or event panel

richgalloway — Thu, 28 Jan 2016 21:47:23 GMT

Use the table command to display the fields (columns) of interest.

Re: Is it possible to display the cleaner version of raw data in a table or event panel

brooklynotss — Thu, 28 Jan 2016 21:51:41 GMT

but then it just displays a super long horizontal table with many columns and two rows. not sure how to turn each field-value pair into a row with two columns.

Re: Is it possible to display the cleaner version of raw data in a table or event panel

somesoni2 — Thu, 28 Jan 2016 22:37:51 GMT

Can anyone see the attached image??

Re: Is it possible to display the cleaner version of raw data in a table or event panel

brooklynotss — Thu, 28 Jan 2016 23:13:27 GMT

weird - looks like it broke. I just re-attached it.

Re: Is it possible to display the cleaner version of raw data in a table or event panel

thunder_wu — Thu, 28 Jan 2016 23:18:50 GMT

I have the exact same need. Table view is not very user friendly.

Re: Is it possible to display the cleaner version of raw data in a table or event panel

MuS — Fri, 29 Jan 2016 00:30:15 GMT

I think the closest result could be this run everywhere example:

  index=_internal | stats values(*) AS * by _time | transpose | rename column AS field | rename "row *" AS value*

This will produce a table with a field field and some values1 fields

Re: Is it possible to display the cleaner version of raw data in a table or event panel

thunder_wu — Fri, 29 Jan 2016 02:33:20 GMT

This works great! Appreciate you sharing this trick.

Any quick way to filter out the default fields date_*, host, source, etc. I just want to present data fields extracted by myself. I know I can take them out one by one, just wonder if there is any short syntax to achieve that.

Re: Is it possible to display the cleaner version of raw data in a table or event panel

MuS — Fri, 29 Jan 2016 02:40:28 GMT

use after the first | a table command and list only the fields you need:

 index=_internal | table myfield1 myfield2 myfield3 | stats values(*) AS * by _time | transpose | rename column AS field | rename "row *" AS value*

Re: Is it possible to display the cleaner version of raw data in a table or event panel

wbcem — Thu, 02 Mar 2017 18:20:43 GMT

Here's a trick I've used now and again, the eval split function. If you have a reliable delimiter, you can split a string into a multi value field. A very handy aspect of multi value fields is that each portion of the multi value field will display on a separate line in the table cell. This is the equivalent of embedding newlines in the variable output.