Dashboards & Visualizations

How do I merge several events, transposing several fields?

atg2
Engager

I am creating a dashboard which contains a query that returns application health events of this type:

Server

Application

Type

Status

 

servername

appname

App Health

UP

 

servername

appname

Disk Health

UP

 

servername

appname

LDAP Health

UP

 

servername

appname

Redis Health

 DOWN

 

 

What I want instead is for the table to look like:

Server

Application

App Health

Disk Health

LDAP Health

Redis Health

servername

appname

UP

UP

UP

DOWN 

 

What would be the best way to accomplish this?

Thank you for any suggestions.

 

Labels (1)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You need to concatenate the server and application, the use xyseries, then split them again

| eval serverapp=server."|".application
| xyseries serverapp type status
| eval server=mvindex(split(serverapp,"|"),0)
| eval application=mvindex(split(serverapp,"|"),1)
| fields - serverapp

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

You need to concatenate the server and application, the use xyseries, then split them again

| eval serverapp=server."|".application
| xyseries serverapp type status
| eval server=mvindex(split(serverapp,"|"),0)
| eval application=mvindex(split(serverapp,"|"),1)
| fields - serverapp

atg2
Engager

Worked great. Thanks so much!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...