There are three ways
1. We can use SPL to write transforming commands like chart and timechart and create tables and visualizations
2. We can use pivots
These two are okay.
If I select any field and click on quick reports, it create visualizations for sure but the events are not in tabular format. Kindly clear the confusion.
@palisetty if you are able to see visualization then you can check just below the search bar that you are under the Visualization
tab. All you need to do is that click on the Statistics
tab and the Tabular results will show up.
For example if you have searched Splunk's _internal
index, you can select a field like sourcetype
and then choose Report > Top values by Time
. If you have any visualization selected last, it would show the Visualization tab with that viz. selected. Here, you can see Statistics tab and click on the same to get the tabular output.
Thank You.
@palisetty if you are able to see visualization then you can check just below the search bar that you are under the Visualization
tab. All you need to do is that click on the Statistics
tab and the Tabular results will show up.
For example if you have searched Splunk's _internal
index, you can select a field like sourcetype
and then choose Report > Top values by Time
. If you have any visualization selected last, it would show the Visualization tab with that viz. selected. Here, you can see Statistics tab and click on the same to get the tabular output.