topic Re: table and lookup in Dashboards & Visualizations

table and lookup

simo — Fri, 21 May 2021 08:21:58 GMT

Hi All,

i have the following situation
a lookup with the following values

value

a table with name and value

name	value
a	1
b	2
a	1
b	2
b	2
a	2
b	1

I would like to be able to view a table as follows on a dashboard. must count how many times there is one of the values in lookup for the name

name	1	2	3
a	2	1	0
b	0	4	0
c	0	0	0

if I add the value 4 in the lookup the table automatically becomes

name	1	2	3	4
a	2	1	0	0
b	0	4	0	0
c	0	0	0	0

thanks for any help

Simone

Re: table and lookup

kamlesh_vaghela — Fri, 21 May 2021 08:41:38 GMT

@simo

Try this .

Thanks
KV
▄︻̷̿┻̿═━一

If this reply helps you, an upvote would be appreciated.

Re: table and lookup

ITWhisperer — Fri, 21 May 2021 08:58:08 GMT

Re: table and lookup

simo — Wed, 26 May 2021 07:21:24 GMT

Hi @ITWhisperer
Thanks for the reply, but it doesn't seem to work 😞

if I add a value b 5

a new column with the value is added 5, but this must not happen because there must be only the columns in the lookup.

Simone

Re: table and lookup

aasabatini — Wed, 26 May 2021 07:54:01 GMT

Hi @simo

did you think to use transponse command?

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transpose

search example

your search | table Name Value | transpose header_field=Value column_name=Field_name

Re: table and lookup

ITWhisperer — Wed, 26 May 2021 08:21:20 GMT

Re: table and lookup

simo — Wed, 26 May 2021 11:00:33 GMT

Hi @ITWhisperer

ok so it goes, but if I have to add another field for example

name	surname	value
mario	rossi	1
marco	ferrari	2
mario	russo	4
marco	ferrari	5
marco	ferrari	1

always assuming the values from 1 to 4, it's possible?

Simone

Re: table and lookup

ITWhisperer — Wed, 26 May 2021 11:05:27 GMT

You would have to concatenate name and surname with a suitable delimiter into a single field before the xyseries, then split the field back into name and surname using the delimiter to separate them.