Splunk Search

How to format a table

ShagVT
Path Finder

I have a search that will produce a pretty basic table like this: index=myindex | chart count by host, partition

host        partition1   partition2
serverA       453                0
serverB        23               23
serverC         0              231

I'm trying to make a dashboard, and for my dashboard, the specific values are not really important.

host        partition1   partition2
serverA         X                
serverB         X               X
serverC                         X

I would be fine with something like this, or a graphical checkmark or something? I'm just looking to show where the non-zero values are. Anything additional I can do to bring attention to those through color-coding etc would be gravy.

Any suggestions?

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Give this a try (will show 1 and blank based on count)

index=myindex | chart dc(host) by host, partition
| foreach * [| eval "<<FIELD>>"=if("<<FIELD>>"!="host" AND '<<FIELD>>'=0,"",'<<FIELD>>')]

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Give this a try (will show 1 and blank based on count)

index=myindex | chart dc(host) by host, partition
| foreach * [| eval "<<FIELD>>"=if("<<FIELD>>"!="host" AND '<<FIELD>>'=0,"",'<<FIELD>>')]

ShagVT
Path Finder

Thanks - I never think of the foreach function.

I modified slightly to end up with X since that's a little easier to spot when the chart has more values:

| foreach * [|eval "<<FIELD>>"=if("<<FIELD>>" != "host" AND '<<FIELD>>'=0, "", '<<FIELD>>')]
| foreach * [|eval "<<FIELD>>"=if('<<FIELD>>' = 1, "X", '<<FIELD>>')]
0 Karma

niketn
Legend

@ShagVT if your issue is resolved please accept the answer to mark this question as answered!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...