Dashboards & Visualizations

How to split up a row into multiple rows?

cris887
New Member

Hi all,

I have a table with these fields -

 

Time/DateKeyRobotProcessHostStatusEnvironmentType
01.01.2022
12:30:00

Key 1

Key 2

Key 3

Robot 1

Robot 2

Robot 3

Process Claim

Process Claim

Process Claim

Host W

Host X

Host Y

Success

Success

Success

Production

Production

Production

Critical

Critical

Critical

01.01.2022
12:30:00

Key 4

Robot 4 

Process Refund

Host Z

Success

Production

Critical

02.02.2022
11:30:00
Key 5Robot 5Process TaxHost VFailedNon-ProductionMinor

 

I want to split up the first row into three rows to show the data. Is there a way I can split these based on the Time/Date and the Process? 

Ideally, I want to generate a new table like this -

Time/DateKeyRobotProcessHostStatusEnvironmentType
01.01.2022
12:30:00


Key 1


 

 

Robot 1

 

 

Process Claim

 

Host W

 

Success

 

Production

 

Critical

 

01.01.2022
12:30:00

Key 2

Robot 2

Process Claim

Host X

Success

Production

Critical

01.01.2022
12:30:00

Key 3

Robot 3

Process Claim

Host Y

Success

Production

Critical

01.01.2022
12:30:00

Key 4

Robot 4 

Process Refund

Host Z

Success

Production

Critical

02.02.2022
11:30:00
Key 5Robot 5Process TaxHost VFailedNon-ProductionMinor

 

 

Labels (4)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @cris887,

only one information: does the above table arrive from a search or or does it come as I can see?

if from a search, you have to modify your search to have the result you want, if it is as I see, you have to define some rule for the splitting.

Ciao.

Giuseppe

0 Karma

cris887
New Member

Hi @gcusello,

 

I have modified my original post to make it clearer. I get these results from a search.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @cris887,

if you could share your search, maybe I can modify it to split the values.

Ciao.

Giuseppe

0 Karma

cris887
New Member

@gcusello 

index=insurance source=* sourcetype=_json

| fields Time/Date, Key, Robot, Process, Host, Status, Environment, Type

 

 

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...