Splunk Search

How to format a table

ShagVT
Path Finder

I have a search that will produce a pretty basic table like this: index=myindex | chart count by host, partition

host        partition1   partition2
serverA       453                0
serverB        23               23
serverC         0              231

I'm trying to make a dashboard, and for my dashboard, the specific values are not really important.

host        partition1   partition2
serverA         X                
serverB         X               X
serverC                         X

I would be fine with something like this, or a graphical checkmark or something? I'm just looking to show where the non-zero values are. Anything additional I can do to bring attention to those through color-coding etc would be gravy.

Any suggestions?

0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try (will show 1 and blank based on count)

index=myindex | chart dc(host) by host, partition
| foreach * [| eval "<<FIELD>>"=if("<<FIELD>>"!="host" AND '<<FIELD>>'=0,"",'<<FIELD>>')]

View solution in original post

somesoni2
Revered Legend

Give this a try (will show 1 and blank based on count)

index=myindex | chart dc(host) by host, partition
| foreach * [| eval "<<FIELD>>"=if("<<FIELD>>"!="host" AND '<<FIELD>>'=0,"",'<<FIELD>>')]

ShagVT
Path Finder

Thanks - I never think of the foreach function.

I modified slightly to end up with X since that's a little easier to spot when the chart has more values:

| foreach * [|eval "<<FIELD>>"=if("<<FIELD>>" != "host" AND '<<FIELD>>'=0, "", '<<FIELD>>')]
| foreach * [|eval "<<FIELD>>"=if('<<FIELD>>' = 1, "X", '<<FIELD>>')]
0 Karma

niketn
Legend

@ShagVT if your issue is resolved please accept the answer to mark this question as answered!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...