Dashboards & Visualizations

How to display the column contents in table?

Sss
Path Finder

I have my report where I have written something like this-

|dbxquery query="select COLUMN1,COLUMN2,COLUMN3,COLUMN4
FROM TABLE1
WHERE COLUMN1 IN ('xyz') ",connection="XXX"

I have added this to my dashboard by using query-

| savedsearch rep1
| chart values(column3) AS Status BY column2 column4
| fillnull value="-"
| table column1 column2 ......

In my dashboard,values of COLUMN1 are not displayed.

Is there any way how i can display value of column1 i.e;xyz

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

That is not a very clear answer. Do you mean something like this?

| stats values(column3) AS Status BY column1 column2 column4
| eval {column4} = Status
| fields - Status column4
| stats values(*) as * by column1 column2
| fillnull value="-"

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

On a less flippant note, please provide more detail.

Do you want to replace some of the existing data in the table, or have the column1 values as extra?

If you want them as extra, how are they to be combined with the existing data?

0 Karma

Sss
Path Finder

I dont want to replace any data,but have to include that Column1 which will display value as 'xyz'.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You still haven't answered the final question. How does column1 relate to the other data you want to display?

For example, is there a one-to-one relationship between column1 and column2, or can there be multiple values of column1 for every combination of column2 and column4?

0 Karma

Sss
Path Finder

The reamining column are with respect to COLUMN1,i.e; its related to that particular group say 'xyz'.

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

That is not a very clear answer. Do you mean something like this?

| stats values(column3) AS Status BY column1 column2 column4
| eval {column4} = Status
| fields - Status column4
| stats values(*) as * by column1 column2
| fillnull value="-"

Sss
Path Finder

Thank you so much,it worked for me

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| chart values(column3) AS Status BY column1 column4
0 Karma

Sss
Path Finder

I have used this command,but only column name is displaying without any data in that column.

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Enterprise 9.4: Features to Power Your Digital Resilience

Hey Splunky People! We are excited to share the latest updates in Splunk Enterprise 9.4. In this release we ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...