splunk lookup

[Siddharthnegi]

I want to show lookup file content horizontally.

eg:-
rather than this

panels
a
b
c

I want

panels a b c    OR         a b c

[bowesmana · Accepted solution]

Try this

| inputlookup your_lookup.csv
| stats values(panels) as panels
| eval panels=mvjoin(panels, " ")

[Siddharthnegi]

Thanks for the quick response  i want it horizontally which it is showing thanks to you , but i want to display all the content in a table can we do that

[bowesmana]

You can do this

| inputlookup panels.csv
| transpose 0

what do you want the column headings to be?

That will give you columns called row 1, row 2, row 3 and so on with the values found.

[bowesmana]

You can also add this on the end of that previous post

which will make the column name the value of the panel and the value of the column=1

| foreach row* [ eval {<<FIELD>>}=1 ]
| fields - row*

[Siddharthnegi]

the result coming is

Panels
Blacklisted Software Exceptions Clients missing critical updates Clients with blacklisted Software Clients with old Defender patterns Critical severity vulnerabilities Defender enrollment status High severity vulnerabilities Local virtual machines Outdated operating systems - Endpoint Outdated operating systems - Unknown Outdated operation systems - Server Servers with blacklisted Software Systems not found in patch management database Total Installed blacklisted Software Vulnerabilities solved

but I want all the result  in different section of table

[Siddharthnegi]

is there table virualization in splunk

[bowesmana]

There is a table visualisation in Splunk and when you run that command you are getting a table visualisation.

Perhaps you can describe your data better, because you are clearly looking for something different than just panels a b c.

Your post describing this 

Panels
Blacklisted Software Exceptions Clients missing critical updates Clients with blacklisted Software Clients with old Defender patterns Critical severity vulnerabilities Defender enrollment status High severity vulnerabilities Local virtual machines Outdated operating systems - Endpoint Outdated operating systems - Unknown Outdated operation systems - Server Servers with blacklisted Software Systems not found in patch management database Total Installed blacklisted Software Vulnerabilities solved

doesn't actually tell me anything useful - can you describe your lookup data, what it contains and give a better description of how you want the data to look in your table.

[Siddharthnegi]

yeah sure
i have a lookup called panels.csv ,

Panels

Critical severity vulnerabilities

High severity vulnerabilities

Vulnerabilities solved

Local virtual machines

Outdated operation systems - Server

Outdated operating systems - Endpoint

Outdated operating systems - Unknown

Defender enrollment status

Clients with old Defender patterns

Systems not found in patch management database

Clients missing critical updates

Servers with blacklisted Software

Clients with blacklisted Software

Total Installed blacklisted Software

Blacklisted Software Exceptions

i want to display them horizontally , which i was using your given search , but the result is coming in this pattern

Blacklisted Software Exceptions Clients missing critical updates Clients with blacklisted Software Clients with old Defender patterns Critical severity vulnerabilities Defender enrollment status High severity vulnerabilities Local virtual machines Outdated operating systems - Endpoint Outdated operating systems - Unknown Outdated operation systems - Server Servers with blacklisted Software Systems not found in patch management database Total Installed blacklisted Software Vulnerabilities solved

i want to display it like this but want to have sections of each content just like table

[bowesmana]

As @yuanliu says, my queries give you a table - if you are indicating the table does not come back in the order the panels are defined in the CSV, that's unfortunately a feature of Splunk.

You can add this final line to order the columns as per the CSV

| fields [ | inputlookup panels.csv | eval Panels="\"".Panels."\"" | stats list(Panels) as Panels | return $Panels ]

[yuanliu]

I cannot understand why you say you are not getting a "table".  Using the lookup sample you gave and the two code samples @bowesmana gave, these are results from my instance

1. Transpose alone

2. Transpose + foreach

Both are just like table.  Are they not?