Splunk Search

how to break fields into separate lines which were concatenated

mnarmada
Path Finder

Hello,

My Situation is different.

I have few columns like:
code, Week, rfs, decision, new_deecision.

In my search, I have concatenated all the fields, to display in a column chart.
If I place cursor on a column, It should show which week it is, code, rfs and decision.
For this I have used a search like below:

| eval All_details=tostring("Week: ")+'WEEK'+tostring(", CODE: ")+'CODE'+tostring(", Current Week RFS3: ")+'RFS3'+tostring(", Previous decision: ")+'decision'+tostring(", Current decision: ")+'new_decision'
| stats count by All_details, WEEK

When I place a cursor on a column of visualization, it is showing all the details in a single line. But I want to see all columns should appear in different lines when I place cursor on a bar or column. Like week in one line, code in next line following by week etc.,

Is there any way to show the fields values in different lines?

Please help me on this.

Thanks,
Narmada.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...