Splunk Search

How to have Pivot Report show both chart and table

pal4life
Path Finder

Hi,
I was reviewing this tutorial on Youtube about how to create Pivot report
https://www.youtube.com/watch?v=MdjDrDTXYWQ#t=1.819614

It shows both the Chart as well as the tablealt text Although when I create a Pivot report it only shows me the chart but not the table below it, how do I get the table to show up below the chart?

So that information is readily available there.

Thanks.

rjthibod
Champion

What you are asking to do requires that you create a dashboard of your own if you want to do it the most efficient way with only a single search.

Without having the original content, I can only show you the pseudocode to product what you are looking for. You will have to plug in the names for DATAMODEL, EVENT_NAME, sales_field, and product_field.

<form>
  <label>Product Sales by Host</label>
  <fieldset autoRun="true" submitButton="false">
    <input type="time" searchWhenChanged="true">
      <label>Search Period</label>
      <default>
        <earliest>-7d@d</earliest>
        <latest>now</latest>
      </default>
    </input> 
  </fieldset>
  <row>
    <panel>
      <chart>
        <search id="search_sales_by_host">
          <query>
            | pivot <DATAMODEL> <EVENT_NAME> sum(<sales_field>) AS sales SPLITROW <product_name_field> as "product name" SPLITCOL host TOP 20 sum(<sales_field>) ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 20 SHOWOTHER 0 
          </query>
        </search>
        <option name="drilldown">none</option>
        <option name="charting.chart">bar</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY.text">Product Name</option>        
        <option name="charting.axisTitleX.text">Sum of Price ($)</option>        
      </chart>
      <table>
        <search base="search_sales_by_host">
        </search>
        <option name="count">20</option>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>
0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...