Splunk Search

How to show multiple records value in same table row?

splunkuser320
Path Finder

I have a job that runs multiple times if it failed. I need to create a dashboard with a table that shows all the attempts with status. 

Logs

{id:"1",retrynumber:"1",uniqueid:"23213131",status:"Failed"}

{id:"1",retrynumber:"2",uniqueid:"43434333",status:"Failed"}

{id:"1",retrynumber:"3",uniqueid:"23213132",status:"Failed"}

{id:"1",retrynumber:"4",uniqueid:"23213154",status:"Passed"}

I want to have table like:

id     retry1     retry2     retry3     retry 5

1      Failed      Failed      Failed      Passed

 

Labels (3)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

If you have valid JSON in your logs and the fields are being extracted, then add this to the search

| eval retry{retrynumber}=status
| fields - retrynumber
| stats values(retry*) as retry* by id

yuanliu
SplunkTrust
SplunkTrust

I've never learned inline dereference with curly brackets.  Thank you, @bowesmana!

0 Karma

bowesmana
SplunkTrust
SplunkTrust

You could also do it this way

| eval retrynumber="retry".retrynumber
| chart values(status) over id by retrynumber
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...