Splunk Search

How to show multiple records value in same table row?

splunkuser320
Path Finder

I have a job that runs multiple times if it failed. I need to create a dashboard with a table that shows all the attempts with status. 

Logs

{id:"1",retrynumber:"1",uniqueid:"23213131",status:"Failed"}

{id:"1",retrynumber:"2",uniqueid:"43434333",status:"Failed"}

{id:"1",retrynumber:"3",uniqueid:"23213132",status:"Failed"}

{id:"1",retrynumber:"4",uniqueid:"23213154",status:"Passed"}

I want to have table like:

id     retry1     retry2     retry3     retry 5

1      Failed      Failed      Failed      Passed

 

Labels (3)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

If you have valid JSON in your logs and the fields are being extracted, then add this to the search

| eval retry{retrynumber}=status
| fields - retrynumber
| stats values(retry*) as retry* by id

yuanliu
SplunkTrust
SplunkTrust

I've never learned inline dereference with curly brackets.  Thank you, @bowesmana!

0 Karma

bowesmana
SplunkTrust
SplunkTrust

You could also do it this way

| eval retrynumber="retry".retrynumber
| chart values(status) over id by retrynumber
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...