Splunk Search

How to have Pivot Report show both chart and table

pal4life
Path Finder

Hi,
I was reviewing this tutorial on Youtube about how to create Pivot report
https://www.youtube.com/watch?v=MdjDrDTXYWQ#t=1.819614

It shows both the Chart as well as the tablealt text Although when I create a Pivot report it only shows me the chart but not the table below it, how do I get the table to show up below the chart?

So that information is readily available there.

Thanks.

rjthibod
Champion

What you are asking to do requires that you create a dashboard of your own if you want to do it the most efficient way with only a single search.

Without having the original content, I can only show you the pseudocode to product what you are looking for. You will have to plug in the names for DATAMODEL, EVENT_NAME, sales_field, and product_field.

<form>
  <label>Product Sales by Host</label>
  <fieldset autoRun="true" submitButton="false">
    <input type="time" searchWhenChanged="true">
      <label>Search Period</label>
      <default>
        <earliest>-7d@d</earliest>
        <latest>now</latest>
      </default>
    </input> 
  </fieldset>
  <row>
    <panel>
      <chart>
        <search id="search_sales_by_host">
          <query>
            | pivot <DATAMODEL> <EVENT_NAME> sum(<sales_field>) AS sales SPLITROW <product_name_field> as "product name" SPLITCOL host TOP 20 sum(<sales_field>) ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 20 SHOWOTHER 0 
          </query>
        </search>
        <option name="drilldown">none</option>
        <option name="charting.chart">bar</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY.text">Product Name</option>        
        <option name="charting.axisTitleX.text">Sum of Price ($)</option>        
      </chart>
      <table>
        <search base="search_sales_by_host">
        </search>
        <option name="count">20</option>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>
0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...