Dashboards & Visualizations

How to add rows to table in dashboard?



I must create a visualization- table. I have several similar tables located at dashboard side by side, the only difference is "Base Level". Client demands the visualization to look aesthetically- that means  the values on the column "Priority difference" should be stable, from -4 to 4 (-4, -3, -2, -1, 0, 1, 2, 3 ,4) and when there would be no logs for that, on the right column "Number" the value should be "0"- like at 1st photo, where I added it manually to visualize the case:


The current final dashboard. At all the dashboards the values on Priority_difference should be always from -4 to 4, now when there are no logs the rows are just missing:splunk_photo2.png

The logs looks like this:

Could you kindly please advise?

Labels (1)
Tags (1)
0 Karma


Not sure why you are using eventstats then dedup when stats will do that in one go

| stats count(Priority_difference) as variable by Priority_difference
| append
    [| makeresults
    | eval Priority_difference=mvrange(-4,5)
    | mvexpand Priority_difference
    | eval variable=0]
| stats sum(variable) as variable by Priority_difference
| sort Priority_difference
| eval Number=variable
| table Priority_difference Number
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...