Dashboards & Visualizations

Merge the rows and give different colors

anooshac
Communicator

Hello,
I am new to splunk. I have a requirement where I need to merge the rows in a table which are of repeating data and give different color to those merged rows. I explored alot but failed to get the answer. Can anyone please help me in this.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@anooshac,

Based on the example ,

"your search" |stats count as Merged by Field1,Field2

This should combine the rows by deleting duplicates and provides you a count of merged rows. Color of the cells can be set if Merged > 1

Here is a run anywhere example

<dashboard>
  <label>Merge Rows</label>
  <row>
    <panel>
      <table>
        <search>
          <query>|makeresults|eval field1="A A A B B B"|makemv field1|mvexpand field1
|appendcols [|makeresults|eval field2="1 1 2 3 3 2"|makemv field2|mvexpand field2]
|stats count as Merged by field1,field2</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="color" field="count">
          <colorPalette type="list">[#FFFFFF,#D93F3C,#D93F3C]</colorPalette>
          <scale type="threshold">2,1000</scale>
        </format>
        <format type="color" field="Merged">
          <colorPalette type="list">[#FFFFFF,#D93F3C]</colorPalette>
          <scale type="threshold">2</scale>
        </format>
      </table>
    </panel>
  </row>
</dashboard>

Reference : https://docs.splunk.com/Documentation/SplunkCloud/latest/Viz/TableFormatsFormatting

If you want to customize the table rendering, please have a look at the Dashboard Examples

Happy Splunking!
0 Karma

anooshac
Communicator

Thanks for the answer. Sorry but I don't want to get the count. I just want to make the above table to look like this.
Field1 Field2
A 1

           2

B. 3

           2

And for the field1 which is being merged with cells I want to give different colors for different values. That is consider value"A" I want to give some color to those 3 cells which are being merged and for cells which are being merged with values "B" different color and so on. And I have alot of data in field1 as well as field2 this is just a dummy data.If you have some suggestions please help me . Thanks alot and really sorry for not explaining it properly.
I don't know why some values are in rectangular box. I am using my cell phone.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@anooshac ,

Are you trying something similar to

<dashboard>
  <label>Merge Rows</label>
  <row>
    <panel>
      <table>
        <search>
          <query>|makeresults|eval field1="A A A B B B"|makemv field1|mvexpand field1
|appendcols [|makeresults|eval field2="1 1 2 3 3 2"|makemv field2|mvexpand field2]
|stats values(field2) as field2 by field1|nomv field2</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <format type="color" field="count">
          <colorPalette type="list">[#FFFFFF,#D93F3C,#D93F3C]</colorPalette>
          <scale type="threshold">2,1000</scale>
        </format>
        <format type="color" field="Merged">
          <colorPalette type="list">[#FFFFFF,#D93F3C]</colorPalette>
          <scale type="threshold">2</scale>
        </format>
        <format type="color" field="field2">
          <colorPalette type="map"></colorPalette>
        </format>
        <format type="color" field="field1">
          <colorPalette type="map">{"A":#65A637,"B":#A2CC3E}</colorPalette>
        </format>
      </table>
    </panel>
  </row>
</dashboard>
Happy Splunking!

renjith_nair
SplunkTrust
SplunkTrust

@anooshac,
What you mean by merging rows? Do you mean deleting the duplicates or making a multi value of the rows ?
Would be great if you could provide some sample/dummy input and expected output (please mask confidential data)

Happy Splunking!
0 Karma

anooshac
Communicator

Yes. I want to delete the duplicates.
Consider the table below which has 2 fields.
Field1 Field2
A. 1
A. 1
A. 2
B. 3
B. 3
B. 2

I want to avoid repetition of values and make the data appear in a single cell. And I want to give colors for rows which are being merged. I have merged the rows using streamstats but I am not getting how to color those merged cells. Please help me in this!
Sorry in the table which I have posted the data of field1 and field2 doesn't have gap.

0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...