Splunk Search

how to break fields into separate lines which were concatenated

mnarmada
Path Finder

Hello,

My Situation is different.

I have few columns like:
code, Week, rfs, decision, new_deecision.

In my search, I have concatenated all the fields, to display in a column chart.
If I place cursor on a column, It should show which week it is, code, rfs and decision.
For this I have used a search like below:

| eval All_details=tostring("Week: ")+'WEEK'+tostring(", CODE: ")+'CODE'+tostring(", Current Week RFS3: ")+'RFS3'+tostring(", Previous decision: ")+'decision'+tostring(", Current decision: ")+'new_decision'
| stats count by All_details, WEEK

When I place a cursor on a column of visualization, it is showing all the details in a single line. But I want to see all columns should appear in different lines when I place cursor on a bar or column. Like week in one line, code in next line following by week etc.,

Is there any way to show the fields values in different lines?

Please help me on this.

Thanks,
Narmada.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...