All Apps and Add-ons
Highlighted

Splunk dashboard tables with Heading and SubHeading

Explorer

Hi All,

Can I create a table that has a heading and subheading as well just like the below example??

Head1 | Head2 |
| SubHead2A | Subhead2B |
data1 value1A value1B
data2 value2A value2B
data3 value2A value3B

Thanks in advance!..

0 Karma
Highlighted

Re: Splunk dashboard tables with Heading and SubHeading

SplunkTrust
SplunkTrust

Not really, but Table Embedding can come pretty close.

Here is an example that will work for you locally, that just uses some common data from index=_internal. It creates a dummy row at the top of the results, and then uses Table Embedding to basically put the two statistics inside their own table inside a field that we just made up... And then it hides the other "real" cells with the "hiddenFields" param.

I pulled out as much as I could into a separate postprocess search. Note that you do need something like the | table stats * to force the field to exist in the base search.

<module name="Search" autoRun="True">
  <param name="search"><![CDATA[
    index=_internal source=*metrics.log group="per_*_thruput" | head 1000 | stats sum(kb) as kb max(eps) as maxEps by group | eval stats="placeholder"
  ]]></param>

  <module name="PostProcess">
    <param name="search"><![CDATA[ 
    | reverse | append [| stats count | eval group="" | fields - count] | reverse | fields group stats kb maxEps | eval kb=if(group=="","<b>kb</b>",kb) | eval maxEps=if(group=="","<b>maxEps</b>", maxEps)
    ]]></param>

    <module name="Pager">

      <module name="Table">
        <param name="hiddenFields">kb, maxEps</param>

        <module name="HTML" group="row.fields.stats">
          <param name="html"><![CDATA[
            <table>
              <tr>
                <td style="border-bottom:0px;width:100px;">$row.fields.kb$</td>
                <td style="border-bottom:0px;">$row.fields.maxEps$</td>
              </tr>
            </table>
          ]]></param>
        </module>
      </module>
    </module>
  </module>
</module>

Make sure to read the docs about Table Embedding that are inside the Sideview Utils app.
navigate within the app's navigation menu to "Module Documentation > The Table Module > Table - Embedding examples"

Here's a screenshot:

alt text

View solution in original post

0 Karma
Highlighted

Re: Splunk dashboard tables with Heading and SubHeading

Explorer

Thanks for this..

0 Karma