Splunk Search

How to customize my statistics table to display field-value pairs vertically in a column(s), not a single row in my dashboard?

splunkrocks2014
Communicator

I have a statistics table that only contains one row in my dashboard, but the table has more than 20 fields which are hard to view by end-users. I would like to find out if there is a workaround to layout the field name and its content vertically.

For instance, the current layout:

field_1    field_2       field_3       field_4
-------    -------       ---------     -------
 a            b             c             d

the new layout:

    field_1:  a
    field_2:  b
    field_3:  c
    field_4:  d

Or this:

    field_1:  a     field_3:  c
    field_2:  b     field_4:  d

Any suggestions?

Thanks.

0 Karma

sundareshr
Legend

Try one of these

base search returning 1 row | untable dummy fields values | fields - dummy

*OR*

base search returning 1 row | transpose | rename column AS fields "row 1" as values
0 Karma

cmerriman
Super Champion

|transpose will lay them out vertically for you.

http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Transpose

you'll probably want to use header_field and int=0 options.

0 Karma
Get Updates on the Splunk Community!

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...