All Apps and Add-ons

Splunk dashboard tables with Heading and SubHeading

jhlopez
Explorer

Hi All,

Can I create a table that has a heading and subheading as well just like the below example??

Head1 | Head2 |
| SubHead2A | Subhead2B |
data1 value1A value1B
data2 value2A value2B
data3 value2A value3B

Thanks in advance!..

0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

Not really, but Table Embedding can come pretty close.

Here is an example that will work for you locally, that just uses some common data from index=_internal. It creates a dummy row at the top of the results, and then uses Table Embedding to basically put the two statistics inside their own table inside a field that we just made up... And then it hides the other "real" cells with the "hiddenFields" param.

I pulled out as much as I could into a separate postprocess search. Note that you do need something like the | table stats * to force the field to exist in the base search.

<module name="Search" autoRun="True">
  <param name="search"><![CDATA[
    index=_internal source=*metrics.log group="per_*_thruput" | head 1000 | stats sum(kb) as kb max(eps) as maxEps by group | eval stats="placeholder"
  ]]></param>

  <module name="PostProcess">
    <param name="search"><![CDATA[ 
    | reverse | append [| stats count | eval group="" | fields - count] | reverse | fields group stats kb maxEps | eval kb=if(group=="","<b>kb</b>",kb) | eval maxEps=if(group=="","<b>maxEps</b>", maxEps)
    ]]></param>

    <module name="Pager">

      <module name="Table">
        <param name="hiddenFields">kb, maxEps</param>

        <module name="HTML" group="row.fields.stats">
          <param name="html"><![CDATA[
            <table>
              <tr>
                <td style="border-bottom:0px;width:100px;">$row.fields.kb$</td>
                <td style="border-bottom:0px;">$row.fields.maxEps$</td>
              </tr>
            </table>
          ]]></param>
        </module>
      </module>
    </module>
  </module>
</module>

Make sure to read the docs about Table Embedding that are inside the Sideview Utils app.
navigate within the app's navigation menu to "Module Documentation > The Table Module > Table - Embedding examples"

Here's a screenshot:

alt text

View solution in original post

0 Karma

sideview
SplunkTrust
SplunkTrust

Not really, but Table Embedding can come pretty close.

Here is an example that will work for you locally, that just uses some common data from index=_internal. It creates a dummy row at the top of the results, and then uses Table Embedding to basically put the two statistics inside their own table inside a field that we just made up... And then it hides the other "real" cells with the "hiddenFields" param.

I pulled out as much as I could into a separate postprocess search. Note that you do need something like the | table stats * to force the field to exist in the base search.

<module name="Search" autoRun="True">
  <param name="search"><![CDATA[
    index=_internal source=*metrics.log group="per_*_thruput" | head 1000 | stats sum(kb) as kb max(eps) as maxEps by group | eval stats="placeholder"
  ]]></param>

  <module name="PostProcess">
    <param name="search"><![CDATA[ 
    | reverse | append [| stats count | eval group="" | fields - count] | reverse | fields group stats kb maxEps | eval kb=if(group=="","<b>kb</b>",kb) | eval maxEps=if(group=="","<b>maxEps</b>", maxEps)
    ]]></param>

    <module name="Pager">

      <module name="Table">
        <param name="hiddenFields">kb, maxEps</param>

        <module name="HTML" group="row.fields.stats">
          <param name="html"><![CDATA[
            <table>
              <tr>
                <td style="border-bottom:0px;width:100px;">$row.fields.kb$</td>
                <td style="border-bottom:0px;">$row.fields.maxEps$</td>
              </tr>
            </table>
          ]]></param>
        </module>
      </module>
    </module>
  </module>
</module>

Make sure to read the docs about Table Embedding that are inside the Sideview Utils app.
navigate within the app's navigation menu to "Module Documentation > The Table Module > Table - Embedding examples"

Here's a screenshot:

alt text

0 Karma

jhlopez
Explorer

Thanks for this..

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...