Splunk Search

How to make column values as headers in dashboard

rcndpatel
Loves-to-Learn

I have a table that looks like...
CUSTOMER ADDRESS CONTACT
A 10 A Road (111)-222-3334
30 C Road (222)333-4444
B 20 B Lane (111)-221-1122
40 D Circle (444)-444-2222

Now I want to us the CUSTOMER name as the header in the table so that it looks like

A


ADDRESS CONTACT
10 A Road (111)-222-3334
30 C Road (222)333-4444

B


20 B Lane (111)-221-1122
40 D Circle (444)-444-2222

0 Karma

to4kawa
SplunkTrust
SplunkTrust
<dashboard>
  <label>header test</label>
  <search id="baseSearch">
    <query>|makeresults 
| eval _raw="CUSTOMER,ADDRESS,CONTACT
A,10 A Road,(111)-222-3334
,30 C Road,(222)333-4444
B,20 B Lane,(111)-221-1122
,40 D Circle,(444)-444-2222"
| multikv forceheader=1
| table CUSTOMER,ADDRESS,CONTACT
| filldown</query>
    <earliest>0</earliest>
    <latest></latest>
    <sampleRatio>1</sampleRatio>
  </search>
  <row>
    <panel>
      <table>
        <title>A</title>
        <search base="baseSearch">
          <query>| where CUSTOMER="A"
            |table ADDRESS CONTACT</query>
        </search>
      </table>
    </panel>
    <panel>
      <table>
        <title>B</title>
        <search base="baseSearch">
          <query>| where CUSTOMER="B"
| table ADDRESS CONTACT</query>
        </search>
      </table>
    </panel>
  </row>
</dashboard>
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.