Dashboards & Visualizations

How to create a dashboard with a fixed table frame to display text data?

rfazio
Explorer

My customer needs a visualization of a boatload of text data (1000's of fields). Not a graphic in the lot.

Imagine a phone book with a persons name, nick names, addresses (home, work, school, previous), phones (all kinds). I can get the raw data dumped out with a simple table, but sometimes the data fields contain really long names that push the table beyond the window. So the customer must use a slider bar to move the screen over.

The amount of data is completely variable, but I'd like to add some structure to the output. All names, all addresses, all phone numbers, etc. I expect the report to be on average 200-300 lines...but can go on much longer.

Ideally, I'd like to set a fixed frame that all fields will fit into (like excel cells) with fixed sizes for each field definition. If data is too large for a field, the left n bytes will show and the rest of the table is maintained.

Thoughts?
Thanks,
faz

0 Karma
1 Solution

masonmorales
Influencer

Rather than have the user scroll horizontally, what if you used the transpose command after the table command in your search?

http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Transpose

View solution in original post

0 Karma

mrgibbon
Contributor

I'd like to do this too, did you find a way of doing it?
Thanks

0 Karma

masonmorales
Influencer

Rather than have the user scroll horizontally, what if you used the transpose command after the table command in your search?

http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Transpose

0 Karma

rfazio
Explorer

I've tried playing with this. I really like the look for testing tools I create. This is something I will use when offering up data for visual comparison. (old / new) data next to each other.

For this usecase, The page will be 10 miles long if I do this. I'm serious about 1000's of fields. I think the user would want to scroll left/right over up/down that much. So little data would be shown in a single 'pane of glass' 🙂

Thanks for the tip!
faz

0 Karma

rfazio
Explorer

Bump...

Still looking for any ideas.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...