topic How to create the below view? in Splunk Search

How to create the below view?

abhi04 — Tue, 29 Sep 2020 20:26:13 GMT

I have a below query:

index="auto_prod_cm_comparisions" sourcetype="auto_prod_details_log" source="/logs/web/output/iwarranty/" "/apps/web/sfw/java/" | search NOT Server_Name=*wb | chart values(Java_Version) over Java_Version by Server_Name

The above query view shows as below

Java_Version -------sat1svmap179.....sat1svmap180.....sat1svmap171....sat1svmap172

jdk170_151--------------..............................jdk170_151................................... jdk170_151

jdk170_171.............. jdk170_171 ........................................jdk170_171

I want the view to be as below,how to do that?

Java_Version -----------------------sat1svmap179.....sat1svmap180.....sat1svmap171....sat1svmap172
jdk170_151 jdk170_171-----------jdk170_171--------jdk170_151------------jdk170_171-----jdk170_151

Re: How to create the below view?

HiroshiSatoh — Fri, 13 Jul 2018 09:13:14 GMT

Do you want to display on a single line?

(your search)|stats values(*) as *

Re: How to create the below view?

abhi04 — Fri, 13 Jul 2018 09:26:34 GMT

@HiroshiSatoh

yes I need in a single line. Above query works for the servers and not under the java_version

Re: How to create the below view?

FrankVl — Fri, 13 Jul 2018 10:09:43 GMT

What exactly do you mean that it doesn't work for the Java_Version field? You mean the multiple values in the field are displayed below each other? That's because it is a multi valued field.

You can combine that into a single value by using | eval Java_Version = mvjoin(Java_Version, " ")

Re: How to create the below view?

abhi04 — Fri, 13 Jul 2018 15:37:07 GMT

@HiroshiSatoh,

The above worked, but now the ordering of columns have changed with Java_Version column now came at the middle. Of what I y=understand after the command "|stats values(*) as *" it has arranged the columns alphabetically. How to rearrange it back to the previous order?

Re: How to create the below view?

FrankVl — Sat, 14 Jul 2018 06:49:06 GMT

You can use the | table field1,field2,... command to order the fields as you desire.