Splunk Search

How to make column values as headers in dashboard

Loves-to-Learn

I have a table that looks like...
CUSTOMER ADDRESS CONTACT
A 10 A Road (111)-222-3334
30 C Road (222)333-4444
B 20 B Lane (111)-221-1122
40 D Circle (444)-444-2222

Now I want to us the CUSTOMER name as the header in the table so that it looks like

A


ADDRESS CONTACT
10 A Road (111)-222-3334
30 C Road (222)333-4444

B


20 B Lane (111)-221-1122
40 D Circle (444)-444-2222

0 Karma

Ultra Champion
<dashboard>
  <label>header test</label>
  <search id="baseSearch">
    <query>|makeresults 
| eval _raw="CUSTOMER,ADDRESS,CONTACT
A,10 A Road,(111)-222-3334
,30 C Road,(222)333-4444
B,20 B Lane,(111)-221-1122
,40 D Circle,(444)-444-2222"
| multikv forceheader=1
| table CUSTOMER,ADDRESS,CONTACT
| filldown</query>
    <earliest>0</earliest>
    <latest></latest>
    <sampleRatio>1</sampleRatio>
  </search>
  <row>
    <panel>
      <table>
        <title>A</title>
        <search base="baseSearch">
          <query>| where CUSTOMER="A"
            |table ADDRESS CONTACT</query>
        </search>
      </table>
    </panel>
    <panel>
      <table>
        <title>B</title>
        <search base="baseSearch">
          <query>| where CUSTOMER="B"
| table ADDRESS CONTACT</query>
        </search>
      </table>
    </panel>
  </row>
</dashboard>
0 Karma