Dashboards & Visualizations

How can I move items in a column into the next column as 'section headers'?

eddieddieddie
Path Finder

I've created a table of test results using stats list() to create a table that looks like this (the application name is only listed once against the group of tests it's related to):

Application TestName Outcome
WebsiteSearch OnePassed
 Contact PagePassed
 Order FormPassed
InternalQuery FormPassed
 Look UpPassed

 

I would like to amend the table so that the Application is shown in the 'TestName' column above the group of tests it's related to, so it looks like this:

TestName Outcome
Website 
Search OnePassed
Contact PagePassed
Order FormPassed
Internal 
Query FormPassed
Look UpPassed

 

I know this breaks normal table data layout but for the purposes of my dashboard I think it will make it look more readable.

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

This kind of summarisation where you insert extra rows for summary is done using appendpipe

 

The logic here with streamstats is to enable the sort to order the rows as needed. This one here will preserve your existing order, but if you want to sort by TestName then you add TestName to the sort. 

| streamstats c 
| appendpipe [
  stats values(Application) as TestName min(c) as mc by Application 
  | eval c=mc-.5
]
| sort c
| fields - Application c mc

 Using streamstats to ensure correct ordering is dependent on the initial order of the data, so this will work with your example

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

This kind of summarisation where you insert extra rows for summary is done using appendpipe

 

The logic here with streamstats is to enable the sort to order the rows as needed. This one here will preserve your existing order, but if you want to sort by TestName then you add TestName to the sort. 

| streamstats c 
| appendpipe [
  stats values(Application) as TestName min(c) as mc by Application 
  | eval c=mc-.5
]
| sort c
| fields - Application c mc

 Using streamstats to ensure correct ordering is dependent on the initial order of the data, so this will work with your example

Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...