Splunk Search

How can I "paginate" a single very wide row as multiple rows with a new "page break" every 4 columns.

New Member

I have no idea how to paginate a tables.

Splunk builds rows by default:

I can convert to a very long row with transpose and get this:
1 2 3 4 5 6 7 8

But I need this:
1 2 3 4
5 6 7 8

I can currently manipulate the individual cells, such as replacing an integer with an icon/highlighting. But how the heck do I make a JavaScript file to render the table in a matrix format?


source="StatesTest.csv" | table State Name | sort State

alt text

Desired Output:

alt text

I appreciate the help!

0 Karma

Esteemed Legend

I know that this is not exactly what you would like but maybe it will get you by until you get a better answer:

source="Cars.csv" | table State Name | sort State | streamstats current=t count AS row | eval page=round((row+1)/4,0) | eval combo=State . "," . Name| stats values(combo) AS combo by page | nomv combo | fields combo
0 Karma

New Member

Thanks. We're getting closer. I'm having trouble replacing the "state" which are 1s and 0s with icons. Before I used this to access individual cells: http://blogs.splunk.com/2014/03/17/custom-icons-in-splunk-6-tables/. Based on your solution the data is one row now, so accessing the "state" value doesn't work anymore. Do you know how to work around this?

0 Karma

Esteemed Legend

I would search answers for keyword paginate and see if somebody else has had/fixed something similar. I gave you the best I can; I cannot think of any good way to "re-cell" the way you need it to.

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...