Dashboards & Visualizations

How to display the column contents in table?

Sss
Path Finder

I have my report where I have written something like this-

|dbxquery query="select COLUMN1,COLUMN2,COLUMN3,COLUMN4
FROM TABLE1
WHERE COLUMN1 IN ('xyz') ",connection="XXX"

I have added this to my dashboard by using query-

| savedsearch rep1
| chart values(column3) AS Status BY column2 column4
| fillnull value="-"
| table column1 column2 ......

In my dashboard,values of COLUMN1 are not displayed.

Is there any way how i can display value of column1 i.e;xyz

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

That is not a very clear answer. Do you mean something like this?

| stats values(column3) AS Status BY column1 column2 column4
| eval {column4} = Status
| fields - Status column4
| stats values(*) as * by column1 column2
| fillnull value="-"

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

On a less flippant note, please provide more detail.

Do you want to replace some of the existing data in the table, or have the column1 values as extra?

If you want them as extra, how are they to be combined with the existing data?

0 Karma

Sss
Path Finder

I dont want to replace any data,but have to include that Column1 which will display value as 'xyz'.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You still haven't answered the final question. How does column1 relate to the other data you want to display?

For example, is there a one-to-one relationship between column1 and column2, or can there be multiple values of column1 for every combination of column2 and column4?

0 Karma

Sss
Path Finder

The reamining column are with respect to COLUMN1,i.e; its related to that particular group say 'xyz'.

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

That is not a very clear answer. Do you mean something like this?

| stats values(column3) AS Status BY column1 column2 column4
| eval {column4} = Status
| fields - Status column4
| stats values(*) as * by column1 column2
| fillnull value="-"

Sss
Path Finder

Thank you so much,it worked for me

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| chart values(column3) AS Status BY column1 column4
0 Karma

Sss
Path Finder

I have used this command,but only column name is displaying without any data in that column.

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...