How to put multiple rows in a table in single row by parsing some criteria?

[krishman23]

I have a search query that gives me data as

--------------------------------------------------
|         {applicationid: app_1                 |
|         data_type: data_A                     |
|         message: message_123                  |
|         }                                     |
---------------------------------------------------
|        {applicationid: app_2                  |
|        data_type: data_A                      |
|       message: message_456                    |
|          }                                    |
-------------------------------------------------
but I need to put this in splunk dash board as
-----------------------------------------------------
|data_type| Applicationid=app_1| Applicationid=app_2|
-----------------------------------------------------
|data_A   | message_123        | message_456        |
|...      |  ...               | ....               |
---------------------------------------------------

[p_gurav · Accepted solution]

Hi ,

try something like this:

 | extract pairdelim="\r\n" kvdelim=":" | chart values(message) over data_type by applicationid

[krishman23]

Seems it works Thanks

[krishman23]

In event

[p_gurav]

The data you are getting from search query giving result in table format or that is single event in example?

[krishman23]

I’m getting In event