I'm very new to Splunk world. Right now I'm facing the below problem regarding the dashboard table. It would be a great help if anyone could provide me a solution.
Problem: I have a simple dashboard table having more than 50 columns. I also have 4 input fields in the table which serve the function of filters for the table.
Q1: Now I want to add a facility in the dashboard that will provide this filter functionality for any field of the table. As there are more than 50 columns, so it's not possible to add separate input fields(drop down) for each column. So is there any functionality in Splunk that will provide me the list of column names in a drop down and another drop down will provide me the values for the corresponding filed, when I choose the field in the 1st drop down?
Q2: Can I add multiple filters dynamically like excel? For example, I want to view data based on the filters of 3 fields. So there would be 3 filters. If I want 4 then there will be facility to add another filter.... like that.
Actually I want a functionality similar to excel filter on columns. Please find attach the image of excel sort functionality of adding multiple level which show the list of fields present in the table and simultaneously provide the capability of adding multiple levels.
I hope to have understood your first question: do you want to adapt your output using filters? in other words display or not one or more columns depending od filter value?
if this is your need you have to insert in your fieldset something like this
<input type="checkbox" token="fieldtoshow"> <label>Fields to display</label> <choice value="_time">Date and Time</choice> <choice value="host">Host</choice> <choice value="source">Source</choice> <choice value="_raw">Log Event</choice> <default>_time,host,source,_raw</default> <initialValue>_time,host,source,_raw</initialValue> <delimiter> </delimiter> </input>
and in your search
| table $fieldtoshow$
About the second question, insert in your form all the filters you need putting a default value for all, so as excel if you insert a value in one filter the filter is active, otherwise your search takes all events.
No, I'm not talking about choosing the columns. Rather, I want all columns to be displayed in the table. I just want the table rows to displayed based on some values of a particular column as it happens in excel. For example, among 50 fields, I have two columns as "policy type" and "priority". So I want those rows of the table that have values "blocking" for "policy type" field and priority 1.
Like this, I want to choose any field and view the data of the table based on the values of that field.
In short, I want the functionality of excel which provide the filter capability on any column.
@rajim, kindly do not downvote unless the answer provided leads to some detrimental effects in your Splunk System.
I see that you have provided further details. I am sure @cusello will try to assist you further with your concerns. You should appreciate the fact that without having access to your system and complete details of your use case/issue, someone is trying to assist you with your question. Rest assured that avid Splunkers like @cusello will be able to resolve the issue that you are facing. 🙂
Kindly refer to following thread before downvoting: https://answers.splunk.com/answers/244111/proper-etiquette-and-timing-for-voting-here-on-ans.html
@niketnilay thank you for your feedback ... I really appreciate @cusello ... I downvoted this reply because it doesn't answer my questions, so that anyone in future doesn't get confused by this answer ... I have done this in the similar way of stackoverflow.com ... I didn't want to demotivate him ... anyway in future, I'll vote according to the above link 🙂
If your intent is to be able to form and edit data in the table (including sort/filter), you can possibly explore Splunk Table Dataset Add On which was introduced in Splunk 6.5.
Following is the link to Data Set Add On, its short video and Splunk Documentation:
If you want to create Filter and Sorting capability for various fields displayed in your table, you would need to code the same in Simple XML. I will try to provide that if Table Dataset is not what you are looking for (unless someone else beats me to it ;))