Splunk Search

How can I "paginate" a single very wide row as multiple rows with a new "page break" every 4 columns.

huy7070
New Member

I have no idea how to paginate a tables.

Splunk builds rows by default:
1
2
3
4
5
6
7
8

I can convert to a very long row with transpose and get this:
1 2 3 4 5 6 7 8

But I need this:
1 2 3 4
5 6 7 8

I can currently manipulate the individual cells, such as replacing an integer with an icon/highlighting. But how the heck do I make a JavaScript file to render the table in a matrix format?

Before:

source="StatesTest.csv" | table State Name | sort State

alt text

Desired Output:

alt text

I appreciate the help!

0 Karma

woodcock
Esteemed Legend

I know that this is not exactly what you would like but maybe it will get you by until you get a better answer:

source="Cars.csv" | table State Name | sort State | streamstats current=t count AS row | eval page=round((row+1)/4,0) | eval combo=State . "," . Name| stats values(combo) AS combo by page | nomv combo | fields combo
0 Karma

huy7070
New Member

Thanks. We're getting closer. I'm having trouble replacing the "state" which are 1s and 0s with icons. Before I used this to access individual cells: http://blogs.splunk.com/2014/03/17/custom-icons-in-splunk-6-tables/. Based on your solution the data is one row now, so accessing the "state" value doesn't work anymore. Do you know how to work around this?

0 Karma

woodcock
Esteemed Legend

I would search answers for keyword paginate and see if somebody else has had/fixed something similar. I gave you the best I can; I cannot think of any good way to "re-cell" the way you need it to.

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...