Splunk Search

How to have Pivot Report show both chart and table

pal4life
Path Finder

Hi,
I was reviewing this tutorial on Youtube about how to create Pivot report
https://www.youtube.com/watch?v=MdjDrDTXYWQ#t=1.819614

It shows both the Chart as well as the tablealt text Although when I create a Pivot report it only shows me the chart but not the table below it, how do I get the table to show up below the chart?

So that information is readily available there.

Thanks.

rjthibod
Champion

What you are asking to do requires that you create a dashboard of your own if you want to do it the most efficient way with only a single search.

Without having the original content, I can only show you the pseudocode to product what you are looking for. You will have to plug in the names for DATAMODEL, EVENT_NAME, sales_field, and product_field.

<form>
  <label>Product Sales by Host</label>
  <fieldset autoRun="true" submitButton="false">
    <input type="time" searchWhenChanged="true">
      <label>Search Period</label>
      <default>
        <earliest>-7d@d</earliest>
        <latest>now</latest>
      </default>
    </input> 
  </fieldset>
  <row>
    <panel>
      <chart>
        <search id="search_sales_by_host">
          <query>
            | pivot <DATAMODEL> <EVENT_NAME> sum(<sales_field>) AS sales SPLITROW <product_name_field> as "product name" SPLITCOL host TOP 20 sum(<sales_field>) ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 20 SHOWOTHER 0 
          </query>
        </search>
        <option name="drilldown">none</option>
        <option name="charting.chart">bar</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY.text">Product Name</option>        
        <option name="charting.axisTitleX.text">Sum of Price ($)</option>        
      </chart>
      <table>
        <search base="search_sales_by_host">
        </search>
        <option name="count">20</option>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...