Splunk Search

How to make column headers multi-lined

ChrisCLewis
Communicator

I wish to have a chart where column headers are broken into three lines and row ones into two

base search|
|eval sepa= Department.".".Name.".".Code
|eval sepa2=slice.",".slice_Name  

|chart   values(Number) over sepa2  by sepa

The table currently looks like this:
spacer x.hr.b3 | y.it.h8

1.name1 2 | 3

2.name2 5 | 1

I'd like this:
x | y
hr | it
b3 | h8

1 | 2 | 3
name1 |
2 | 5 | 1
name2 |

The split will work to sort out the row headers (sepa2)

Is there a way to do similar to the column headers that won't create multiple columns?

e.g. makemv / expandmv creates the following.
x |hr | b3 | y | it | h8
\r\n does not appear to work

Many thanks for your time.

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...