Splunk Search

How to customize my statistics table to display field-value pairs vertically in a column(s), not a single row in my dashboard?

splunkrocks2014
Communicator

I have a statistics table that only contains one row in my dashboard, but the table has more than 20 fields which are hard to view by end-users. I would like to find out if there is a workaround to layout the field name and its content vertically.

For instance, the current layout:

field_1    field_2       field_3       field_4
-------    -------       ---------     -------
 a            b             c             d

the new layout:

    field_1:  a
    field_2:  b
    field_3:  c
    field_4:  d

Or this:

    field_1:  a     field_3:  c
    field_2:  b     field_4:  d

Any suggestions?

Thanks.

0 Karma

sundareshr
Legend

Try one of these

base search returning 1 row | untable dummy fields values | fields - dummy

*OR*

base search returning 1 row | transpose | rename column AS fields "row 1" as values
0 Karma

cmerriman
Super Champion

|transpose will lay them out vertically for you.

http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Transpose

you'll probably want to use header_field and int=0 options.

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

State of Splunk Careers 2024: Maximizing Career Outcomes and the Continued Value of ...

For the past four years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

Data-Driven Success: Splunk & Financial Services

Splunk streamlines the process of extracting insights from large volumes of data. In this fast-paced world, ...