topic Re: How can I "paginate" a single very wide row as multiple rows with a new "page break" every 4 columns. in Splunk Search

How can I "paginate" a single very wide row as multiple rows with a new "page break" every 4 columns.

huy7070 — Thu, 25 Jun 2015 20:04:04 GMT

I have no idea how to paginate a tables.

Splunk builds rows by default:
1
2
3
4
5
6
7
8

I can convert to a very long row with transpose and get this:
1 2 3 4 5 6 7 8

But I need this:
1 2 3 4
5 6 7 8

I can currently manipulate the individual cells, such as replacing an integer with an icon/highlighting. But how the heck do I make a JavaScript file to render the table in a matrix format?

Before:

source="StatesTest.csv" | table State Name | sort State

Desired Output:

I appreciate the help!

Re: How can I "paginate" a single very wide row as multiple rows with a new "page break" every 4 columns.

woodcock — Fri, 26 Jun 2015 15:31:25 GMT

I know that this is not exactly what you would like but maybe it will get you by until you get a better answer:

source="Cars.csv" | table State Name | sort State | streamstats current=t count AS row | eval page=round((row+1)/4,0) | eval combo=State . "," . Name| stats values(combo) AS combo by page | nomv combo | fields combo

Re: How can I "paginate" a single very wide row as multiple rows with a new "page break" every 4 columns.

huy7070 — Fri, 26 Jun 2015 19:09:12 GMT

Thanks. We're getting closer. I'm having trouble replacing the "state" which are 1s and 0s with icons. Before I used this to access individual cells: http://blogs.splunk.com/2014/03/17/custom-icons-in-splunk-6-tables/. Based on your solution the data is one row now, so accessing the "state" value doesn't work anymore. Do you know how to work around this?

Re: How can I "paginate" a single very wide row as multiple rows with a new "page break" every 4 columns.

woodcock — Mon, 29 Jun 2015 22:25:36 GMT

I would search answers for keyword paginate and see if somebody else has had/fixed something similar. I gave you the best I can; I cannot think of any good way to "re-cell" the way you need it to.