topic How to format a table in Splunk Search

How to format a table

ShagVT — Tue, 13 Aug 2019 20:34:00 GMT

I have a search that will produce a pretty basic table like this: index=myindex | chart count by host, partition

host        partition1   partition2
serverA       453                0
serverB        23               23
serverC         0              231

I'm trying to make a dashboard, and for my dashboard, the specific values are not really important.

host        partition1   partition2
serverA         X                
serverB         X               X
serverC                         X

I would be fine with something like this, or a graphical checkmark or something? I'm just looking to show where the non-zero values are. Anything additional I can do to bring attention to those through color-coding etc would be gravy.

Any suggestions?

Re: How to format a table

somesoni2 — Tue, 13 Aug 2019 20:52:49 GMT

Give this a try (will show 1 and blank based on count)

index=myindex | chart dc(host) by host, partition
| foreach * [| eval "<<FIELD>>"=if("<<FIELD>>"!="host" AND '<<FIELD>>'=0,"",'<<FIELD>>')]

Re: How to format a table

ShagVT — Tue, 13 Aug 2019 21:37:27 GMT

Thanks - I never think of the foreach function.

I modified slightly to end up with X since that's a little easier to spot when the chart has more values:

| foreach * [|eval "<<FIELD>>"=if("<<FIELD>>" != "host" AND '<<FIELD>>'=0, "", '<<FIELD>>')]
| foreach * [|eval "<<FIELD>>"=if('<<FIELD>>' = 1, "X", '<<FIELD>>')]

Re: How to format a table

niketn — Wed, 14 Aug 2019 02:22:03 GMT

@ShagVT if your issue is resolved please accept the answer to mark this question as answered!