Dashboards & Visualizations

Two dimentional table with static headers (row and column) and dynamically values

shayhibah
Path Finder

Hi,
I would like to create the following table:

alt text

The values inside the table should be filled based on search results.
I tired so many option but I could not find a solution to this.

Does anyone have the correct full answer?

Tags (1)
0 Karma

mayurr98
Super Champion

can you give sample 2-3 events and output you want?

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@shayhibah

You can achieve this by the following search.

YOUR_SEARCH | append [
| makeresults | eval Fields="A,B,C,D,E", Fields=split(Fields,",") | mvexpand Fields | eval Blue="", Red="" | table Fields Blue Red ] | stats values(Blue) as Blue values(Red) as Red by Fields

I have used field Fields to define "A,B,C,D,E" values. You can change it as per your requirement.

Note:

YOUR_SEARCH should return column Fields with "A,B,C,D,E" values and Red Blue column. It might be all OR some values.

Please try and let me know if any help required.

Thanks

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...