Splunk Search

How to customize my statistics table to display field-value pairs vertically in a column(s), not a single row in my dashboard?

splunkrocks2014
Communicator

I have a statistics table that only contains one row in my dashboard, but the table has more than 20 fields which are hard to view by end-users. I would like to find out if there is a workaround to layout the field name and its content vertically.

For instance, the current layout:

field_1    field_2       field_3       field_4
-------    -------       ---------     -------
 a            b             c             d

the new layout:

    field_1:  a
    field_2:  b
    field_3:  c
    field_4:  d

Or this:

    field_1:  a     field_3:  c
    field_2:  b     field_4:  d

Any suggestions?

Thanks.

0 Karma

sundareshr
Legend

Try one of these

base search returning 1 row | untable dummy fields values | fields - dummy

*OR*

base search returning 1 row | transpose | rename column AS fields "row 1" as values
0 Karma

cmerriman
Super Champion

|transpose will lay them out vertically for you.

http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Transpose

you'll probably want to use header_field and int=0 options.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...