Splunk Search

How to customize my statistics table to display field-value pairs vertically in a column(s), not a single row in my dashboard?

splunkrocks2014
Communicator

I have a statistics table that only contains one row in my dashboard, but the table has more than 20 fields which are hard to view by end-users. I would like to find out if there is a workaround to layout the field name and its content vertically.

For instance, the current layout:

field_1    field_2       field_3       field_4
-------    -------       ---------     -------
 a            b             c             d

the new layout:

    field_1:  a
    field_2:  b
    field_3:  c
    field_4:  d

Or this:

    field_1:  a     field_3:  c
    field_2:  b     field_4:  d

Any suggestions?

Thanks.

0 Karma

sundareshr
Legend

Try one of these

base search returning 1 row | untable dummy fields values | fields - dummy

*OR*

base search returning 1 row | transpose | rename column AS fields "row 1" as values
0 Karma

cmerriman
Super Champion

|transpose will lay them out vertically for you.

http://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Transpose

you'll probably want to use header_field and int=0 options.

0 Karma
Get Updates on the Splunk Community!

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...

Splunk and Fraud

Watch Now!Watch an insightful webinar where we delve into the innovative approaches to solving fraud using the ...