Add column names to already existing column names

[Chinmai]

Hello,

I have excel data as shown in the attached screenshot, I want to have same report in my splunk enterprise with same data.

Any one has any idea how to do this?

Thanks in advance.

[Masa]

I've seen such tables as a result of "pivoting Data Frame".

Af far as I know,
if you're looking for the exact table format, Splunk does not ship built-in feature like that.

In Splunk's built-in table, if we really try to display such data, a table format would be as follows;

---------------+-----------------------------------------------------------------------------------------
Col01          | Main01:Sub01 | Main01:Sub02 | Main02:Sub01 | Main02:Sub02 | Main03:Sub01 | Main03:Sub02
---------------+-----------------------------------------------------------------------------------------
ACTUALS        | 
ACTUALS        | 
ACTUALS        | 
ACTUALS        | 
ASSUMPTIOIN    | 
ASSUMPTIOIN    | 
ASSUMPTIOIN    | 
ASSUMPTIOIN    | 
ASSUMPTIOIN    | 
ASSUMPTIOIN    | 
RECOMMENDATION |
RECOMMENDATION |
RECOMMENDATION |
RECOMMENDATION |
.....

[Chinmai]

Thanks for your answer, but how to do this? or is there any way using table embedding?

[Masa]

Can you post several sample data, and real tables you're looking for based on the sample events?
Otherwise, I cannot tell if that's possible in your case. I was posing possible data format.

[DalJeanis]

Okay, your layout is a bit vague. There are a couple of ways to achieve this, but the exact method is going to depend on what kind of data is in each of those columns. Also, it will partly depend on whether columns 6 and 7 are the labels for the rows in each of the action/assumption/recommendation areas. Is there something secret or proprietary about the actual layout, or were you just trying to make the question generic?

[Chinmai]

Hi Dal Jeanis,

Lets assume the data are numeric values and any one column has string value lets say col8.
Do you know any way to do this? I just want the same excel report in the splunk dashboard. that's all.
Can this be done with custom search command?

Many Thanks in advance:)

[Chinmai]

This is just a generic question, col5 -col10 are the labels for data in each action/assumption/recommendation areas. col1-col3 are labels for col9-col10. The basic question here I am asking is how can I add column names to already existing column names. Like here, under col1, there should be col9 and col10. And under col2, there should be col9 and col10. How can I achieve this?