topic Re: Table representation in splunk in Dashboards & Visualizations

How to achieve this table representation in Splunk?

Sss — Fri, 09 Jun 2023 13:11:32 GMT

I have used savedsearch query as-

| savedsearch REPORT1
| stats list(COLUMN8) AS COLUMN 8 list(COLUMN 9) AS COLUMN 9 list(COLUMN 10) AS COLUMN 10 BY COLUMN1 COLUMN2 COLUMN3 COLUMN4 COLUMN5 COLUMN6 COLUMN7

and i got something like this,(fig 1)

But I wanted this to be shown in the below format,(fig 2)

I could only get last 6 columns by using chart command like-

chart values(COLUMN8) AS Status OVER COLUMN 9 BY COLUMN 10

By using this chart command i could get this,(fig 3)

But I want this all together like in (fig 2)

Is there any other way where I can change my search query to get in this format,whether splunk supports combining both chart and stats commands.

Re: Table representation in splunk

gcusello — Fri, 09 Jun 2023 07:09:17 GMT

Hi @Sss,

it isn't possible to have a report like the one you like: Splunk isn't Excel.

You could ave a report like the one you like having a different row for each COLUMN9 and repeating all the values for all the columns, using something like this:

| savedsearch REPORT1 | stats values(eval(if(COLUMN10="ver1",COLUMN8,"-") AS ver1 values(eval(if(COLUMN10="ver2",COLUMN8,"-") AS ver2 values(eval(if(COLUMN10="ver3",COLUMN8,"-") AS ver3 values(eval(if(COLUMN10="ver4",COLUMN8,"-") AS ver4 values(eval(if(COLUMN10="ver5",COLUMN8,"-") AS ver5 BY COLUMN1 COLUMN2 COLUMN3 COLUMN4 COLUMN5 COLUMN6 COLUMN7 COLUMN9

Ciao.

Giuseppe

Re: Table representation in splunk

Sss — Fri, 09 Jun 2023 07:10:58 GMT

okay thank you,I will try with this.

Re: Table representation in splunk

PickleRick — Fri, 09 Jun 2023 07:27:23 GMT

With some clever tricks you might get the right side to display the "matrix" of ver/point values but there is no "merging" in splunk tables and you'd get repeated values in left columns.

Re: Table representation in splunk

ITWhisperer — Fri, 09 Jun 2023 07:28:29 GMT

| eval {COLUMN_10}=COLUMN_8 | fillnull value="_" | stats list(*) AS * BY COLUMN_1 COLUMN_2 COLUMN_3 COLUMN_4 COLUMN_5 COLUMN_6 COLUMN_7 | fields - COLUMN_8 COLUMN_10

Re: Table representation in splunk

PickleRick — Fri, 09 Jun 2023 07:52:57 GMT

Ahhh. Can't get used to this {field} construct.

Still, multivalues fields displayed this way is a kind of "cheating" 😉 And it has a great potential of going haywire when you get multilined values in those fields.

Re: Table representation in splunk

Sss — Fri, 09 Jun 2023 09:03:05 GMT

how can I display cell with its respective color say if COLUMN 7 has its value as red,how can I fill that particular cell as red in my xml code?

Re: Table representation in splunk

PickleRick — Fri, 09 Jun 2023 09:13:02 GMT

https://docs.splunk.com/Documentation/SplunkCloud/9.0.2303/Viz/TableFormatsFormatting
(It's for Cloud but the same applies to Splunk Enterprise).

Re: Table representation in splunk

Sss — Fri, 09 Jun 2023 09:16:24 GMT

thank you so much,it worked for me.