topic Re: Table representation in Dashboards & Visualizations

Is there any way to represent this in Splunk when table formats are different in comparison to database?

Sss — Wed, 07 Jun 2023 12:23:21 GMT

I have to export data from database table where the table format is as shown below,

But,I want this data to be represented in splunk in different table format like this,

Is there any way to represent this in splunk when table formats are different in comparison to database.

gcusello — Wed, 07 Jun 2023 09:26:34 GMT

you have to use the chart command, something like this:

<your_search> | chart values(Status) AS Status OVER Profile BY version

Ciao.

Giuseppe

isoutamo — Wed, 07 Jun 2023 09:27:57 GMT

And add

| fillnull value="_"

to the end of @gcusello 's SPL

Sss — Wed, 07 Jun 2023 09:29:19 GMT

thank you,I will try doing this way

Sss — Wed, 07 Jun 2023 09:29:44 GMT

okay thank you.

Sss — Wed, 07 Jun 2023 11:02:44 GMT

I tried this and got the result thanks,but if at all i need to add two more columns into it

where database table is like,

and i want this data to be represented in splunk as below,

How can we add two more columns in our chart command -

| chart values(Status) AS Status OVER Profile BY version