search results in tree view

[yaminims]

I have a query which gives values repeated in a metric, hence i am reaching out to find out if SPLUNK supports enabling Tree view for search results

E.g.:

This is the current result

Value1 ABC 50
Value1 BCD 20
Value1 CDE 10
Value1 EFG 11
Value2 ABC 50
Value2 BCD 20

I am trying to find out if there is a way to turn on the Tree view in the result set for SPLUNK:

E.g:

• Value1
• Value2

if we expand the Value1 the above list for Value1 should be displayed

[sideview]

Well you can do it by implementing a series of clickable tables in a custom view.

For instance if you are using Sideview Utils, and your base search was

foo bar | stats count by field1 field2

You could have

<module name="Search">
  <param name="search">foo bar | stats count by field1 field2</param>
  <module name="JobProgressIndicator"></module>
  <module name="PostProcess">
    <param name="search">stats sum(count) as count by field1</param>
    <module name="Pager">
      <module name="Table">
        <module name="PostProcess">
          <param name="search">search field1="$row.fields.field1$" | stats sum(count) as count by field2</param>
          <module name="Pager">
            <module name="Table"></module>
          </module>
        </module>
      </module>
    </module>
  </module>
</module>

This would display an intial table with just the "value1", "value2" values, and the aggregate counts, and clicking the rows on that table would show a second table with the ABC, BCD, CDR values specific to that first value, and the counts thereof. You would probably want to add in some headers, with maybe the HTML module.

To do this sort of view in just the core Splunk advanced XML would be possible although it would be a great deal more verbose, you wouldn't be able to use postProcess, and you'd have to understand how intentions work. But it could be done that way too.