Splunk Search

how to break fields into separate lines which were concatenated

mnarmada
Path Finder

Hello,

My Situation is different.

I have few columns like:
code, Week, rfs, decision, new_deecision.

In my search, I have concatenated all the fields, to display in a column chart.
If I place cursor on a column, It should show which week it is, code, rfs and decision.
For this I have used a search like below:

| eval All_details=tostring("Week: ")+'WEEK'+tostring(", CODE: ")+'CODE'+tostring(", Current Week RFS3: ")+'RFS3'+tostring(", Previous decision: ")+'decision'+tostring(", Current decision: ")+'new_decision'
| stats count by All_details, WEEK

When I place a cursor on a column of visualization, it is showing all the details in a single line. But I want to see all columns should appear in different lines when I place cursor on a bar or column. Like week in one line, code in next line following by week etc.,

Is there any way to show the fields values in different lines?

Please help me on this.

Thanks,
Narmada.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...