Dashboards & Visualizations

Table of "Single value"s

darioapis
Explorer

Hi, I want to have table of single values (single values with indicator of movement(percentage)). The first column is name and the second is the single value. Name should be loaded from csv, for example with inputlookup. The second column should be a result of a new search. So can anyone help me construct some backbone of that search. Main problem would probably be table of single values and how to generate new search with every line in that csv.
Thanks.

0 Karma
1 Solution

woodcock
Esteemed Legend

No, no, no. You should not be generating multiple searches. Generate one big search with many OR clauses and then use the newish Trellis feature:

https://docs.splunk.com/Documentation/Splunk/latest/Viz/VisualizationTrellis

View solution in original post

woodcock
Esteemed Legend

No, no, no. You should not be generating multiple searches. Generate one big search with many OR clauses and then use the newish Trellis feature:

https://docs.splunk.com/Documentation/Splunk/latest/Viz/VisualizationTrellis

darioapis
Explorer

thanks very much 🙂

0 Karma

adonio
Ultra Champion

what is the data looks like? what is the common field for the lookup?
my guess is that you would like to use sparkline as this is the "Indicator of movement" for a table visualizations.
what search have you tried so far?
with all the respect, please give us a little but more
its almost seems like you are asking us to do your homework for you

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...