topic Re: creating nested tables in Splunk Search

creating nested tables

smolcj — Mon, 25 Feb 2013 05:44:17 GMT

Hi , my search is like specified below,
Index=main source=file.txt xxx=*| stats values(a) values(b) values(c) by xxx
Gives the table

Xxx       values(a)        values(b)          values(c)
So       qq                sss               sss
Wqq      wewe              wewe              wew
we       wew               wew               wewe

can I change the layout of the table like this, I tried using append and appendcols, I know something I am missing please help to make the table like below

xxx    values(a)        values(b)         values(c)
So
       Qq               sss               sss
Wqq
      Wewe              wewe              ww
We
      Ss                ss                 ss
Ss
     Ass               asa                 blaabla

Please help

Re: creating nested tables

martin_mueller — Mon, 25 Feb 2013 07:59:27 GMT

You could duplicate every event, and then blank out fields depending on whether it's an odd or even row.

Re: creating nested tables

smolcj — Mon, 25 Feb 2013 08:53:26 GMT

Thanks martin, but is there something that i can duplicate table entries ?? and how to check the rownumber in splunk ??
and one more issue is , what if one the table entries doesnt have a nested field?
can u suggest something?

Re: creating nested tables

martin_mueller — Mon, 25 Feb 2013 09:09:34 GMT

For duplicating events look at mvexpand, for row numbers look at streamstats.

Re: creating nested tables

bellaed — Mon, 25 Feb 2013 12:31:55 GMT

appended streamstats count and it is working... but mvexpand is confusing,,
if i do ...|Index=main source=file.txt xxx=*| stats values(a) values(b) values(c) by xxx |mvexpand values(a)|mvexpand(b)
i am getting the same events, the table entries are not duplicated..
tried something like
mvzip(a,b)|rex field..
still the same
Am i doing it wrong?

Re: creating nested tables

martin_mueller — Mon, 25 Feb 2013 12:44:06 GMT

First, you appear to confuse your splunkbase accounts 🙂

Second, mvexpand can only duplicate events if there is a multivalued field with more than one entry. Hence you need to create a temporary field with two values, mvexpand on that, then remove it again.

Re: creating nested tables

sideview — Tue, 26 Feb 2013 05:36:56 GMT

After some emails, smolcj and I discovered that the reason this solution was being pursued was just to improve the general readability of the Table. That's to say the leftmost column was a really a header for the row, and the request had come in to space things out in the table so that the header was higher than the content.

I made the suggestion of looking into the Embedding feature of the Table module, because it would be dead-simple to just embed HTML modules into the particular cells as necessary so that the 'data' cells had some padding on the top edge.

And I hear that this has worked out well as the solution.

Here's the code that smolcj used as a proof-of-concept, and if you haven't read the "Table - Custom Embedding" documentation in Sideview Utils, this will look a little odd. It basically takes all the "Connection" cells in the table and wraps each of them in a div that adds top padding so as to push down the data. If done to all of the "data" cells, it would make the leftmost cell of each row look like a header for that row. You could also use the same effect to wrap the leftmost values in <b> tags or anything you like.

<module name="Search" layoutPanel="panel_row2_col1" autoRun="True">
  <param name="search"><![CDATA[
    index=infa sourcetype=session-log source=*SUCCESS* sess_trans_type=* | stats values(sess_trans_type) as Transtype,  values(sess_connection) as Connection, values(sess_codepage) as Codepage,  values(sess_sql_query) as Query by sess_trans_name
  ]]></param>

  <module name="Pager">
    <param name="count">5</param>
    <module name="Table">
      <param name="hiddenFields">Codepage,Query</param>
      <module name="HTML" group="row.fields.Connection">
        <param name="html"><![CDATA[
          <div style="padding-top:15px;width: 500px;">
            Connection = <b>$row.fields.Connection$</b><br> Codepage = <b>$row.fields.Codepage$</b><br> 
          </div>
        ]]></param>
      </module>
    </module>
  </module>
</module>