topic Re: Splunk Classic Dashboard Event Panel Table Visualization in Dashboards & Visualizations

Splunk Classic Dashboard Event Panel Table Visualization

lcguilfoil — Tue, 11 Mar 2025 17:10:51 GMT

I am creating a Classic Dashboard. I have a Events Panel that is in the Table format. The headers for the table are the following events: _time, host, source, and sourcetype. These are the "Selected Fields". However, there are other fields that I would like to include as "Selected" so that they show up on the header. Is there anyway to do that?

<panel> <event> <search> <query>index=*</query> <earliest>$global_time.earliest$</earliest> <latest>$global_time.latest$</latest> </search> <option name="type">table</option> </event> </panel>

Re: Splunk Classic Dashboard Event Panel Table Visualization

ITWhisperer — Tue, 11 Mar 2025 17:25:14 GMT

Try using the table command in your query

index=* | table _time, host, source, sourcetype, otherfield1, otherfield2

Re: Splunk Classic Dashboard Event Panel Table Visualization

lcguilfoil — Tue, 11 Mar 2025 17:28:15 GMT

Hello! Thank you for your response. I tried that. However, the Selected Field headers are still just _time, host, source, and sourcetype. The footer Event Fields that appear when I expand the event do include the fields that I put in the table command (ex: Level, Details, etc), but don't appear as the headers or the Selected Fields.

Re: Splunk Classic Dashboard Event Panel Table Visualization

lcguilfoil — Tue, 11 Mar 2025 17:34:40 GMT

I figured it out! I added the fields:

<panel> <event> <search> <query>index=*</query> <earliest>$global_time.earliest$</earliest> <latest>$global_time.latest$</latest> </search> <fields>field, field2, field3</fields> <option name="type">table</option> </event> </panel>