Splunk Search

How to format a table

ShagVT
Path Finder

I have a search that will produce a pretty basic table like this: index=myindex | chart count by host, partition

host        partition1   partition2
serverA       453                0
serverB        23               23
serverC         0              231

I'm trying to make a dashboard, and for my dashboard, the specific values are not really important.

host        partition1   partition2
serverA         X                
serverB         X               X
serverC                         X

I would be fine with something like this, or a graphical checkmark or something? I'm just looking to show where the non-zero values are. Anything additional I can do to bring attention to those through color-coding etc would be gravy.

Any suggestions?

0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try (will show 1 and blank based on count)

index=myindex | chart dc(host) by host, partition
| foreach * [| eval "<<FIELD>>"=if("<<FIELD>>"!="host" AND '<<FIELD>>'=0,"",'<<FIELD>>')]

View solution in original post

somesoni2
Revered Legend

Give this a try (will show 1 and blank based on count)

index=myindex | chart dc(host) by host, partition
| foreach * [| eval "<<FIELD>>"=if("<<FIELD>>"!="host" AND '<<FIELD>>'=0,"",'<<FIELD>>')]

ShagVT
Path Finder

Thanks - I never think of the foreach function.

I modified slightly to end up with X since that's a little easier to spot when the chart has more values:

| foreach * [|eval "<<FIELD>>"=if("<<FIELD>>" != "host" AND '<<FIELD>>'=0, "", '<<FIELD>>')]
| foreach * [|eval "<<FIELD>>"=if('<<FIELD>>' = 1, "X", '<<FIELD>>')]
0 Karma

niketn
Legend

@ShagVT if your issue is resolved please accept the answer to mark this question as answered!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...