Dashboards & Visualizations

How to split up a row into multiple rows?

cris887
New Member

Hi all,

I have a table with these fields -

 

Time/DateKeyRobotProcessHostStatusEnvironmentType
01.01.2022
12:30:00

Key 1

Key 2

Key 3

Robot 1

Robot 2

Robot 3

Process Claim

Process Claim

Process Claim

Host W

Host X

Host Y

Success

Success

Success

Production

Production

Production

Critical

Critical

Critical

01.01.2022
12:30:00

Key 4

Robot 4 

Process Refund

Host Z

Success

Production

Critical

02.02.2022
11:30:00
Key 5Robot 5Process TaxHost VFailedNon-ProductionMinor

 

I want to split up the first row into three rows to show the data. Is there a way I can split these based on the Time/Date and the Process? 

Ideally, I want to generate a new table like this -

Time/DateKeyRobotProcessHostStatusEnvironmentType
01.01.2022
12:30:00


Key 1


 

 

Robot 1

 

 

Process Claim

 

Host W

 

Success

 

Production

 

Critical

 

01.01.2022
12:30:00

Key 2

Robot 2

Process Claim

Host X

Success

Production

Critical

01.01.2022
12:30:00

Key 3

Robot 3

Process Claim

Host Y

Success

Production

Critical

01.01.2022
12:30:00

Key 4

Robot 4 

Process Refund

Host Z

Success

Production

Critical

02.02.2022
11:30:00
Key 5Robot 5Process TaxHost VFailedNon-ProductionMinor

 

 

Labels (4)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @cris887,

only one information: does the above table arrive from a search or or does it come as I can see?

if from a search, you have to modify your search to have the result you want, if it is as I see, you have to define some rule for the splitting.

Ciao.

Giuseppe

0 Karma

cris887
New Member

Hi @gcusello,

 

I have modified my original post to make it clearer. I get these results from a search.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @cris887,

if you could share your search, maybe I can modify it to split the values.

Ciao.

Giuseppe

0 Karma

cris887
New Member

@gcusello 

index=insurance source=* sourcetype=_json

| fields Time/Date, Key, Robot, Process, Host, Status, Environment, Type

 

 

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...