Dashboards & Visualizations

Methods to create tables and visualizations

palisetty
Communicator

There are three ways
1. We can use SPL to write transforming commands like chart and timechart and create tables and visualizations
2. We can use pivots

These two are okay.

  1. We can create from the fields sidebar. I don't know how is it done?

If I select any field and click on quick reports, it create visualizations for sure but the events are not in tabular format. Kindly clear the confusion.

Tags (1)
0 Karma
1 Solution

niketn
Legend

@palisetty if you are able to see visualization then you can check just below the search bar that you are under the Visualization tab. All you need to do is that click on the Statistics tab and the Tabular results will show up.

For example if you have searched Splunk's _internal index, you can select a field like sourcetype and then choose Report > Top values by Time. If you have any visualization selected last, it would show the Visualization tab with that viz. selected. Here, you can see Statistics tab and click on the same to get the tabular output.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

palisetty
Communicator

Thank You.

0 Karma

niketn
Legend

@palisetty if you are able to see visualization then you can check just below the search bar that you are under the Visualization tab. All you need to do is that click on the Statistics tab and the Tabular results will show up.

For example if you have searched Splunk's _internal index, you can select a field like sourcetype and then choose Report > Top values by Time. If you have any visualization selected last, it would show the Visualization tab with that viz. selected. Here, you can see Statistics tab and click on the same to get the tabular output.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf24, and Community Connections

Thank you to everyone in the Splunk Community who joined us for .conf24 – starting with Splunk University and ...

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...