The feature you are looking for is trellis. But Splunk doesn't currently do trellis for table visualization. (I'm almost sure that Grafana does.) You can sort of hack something yourself if you are ...
See more...
The feature you are looking for is trellis. But Splunk doesn't currently do trellis for table visualization. (I'm almost sure that Grafana does.) You can sort of hack something yourself if you are willing to get into the nitty-gritty Simple XML programming. (Or in Dashboard Studio source.) Oh, you also need to know all possible values of SectionName in advance. The basic idea is Run a <query /> to populate an aggregate token with values of Attribute in the same search window, e.g., index = websphere_cct (Object= "HJn5server1" Env="Prod") OR (Object = "HJn7server3" Env="UAT") SectionName="Process Definition"
| spath path=Attributes
| eval Attributes = mvappend("SectionName", json_array_to_mv(json_keys(Attributes))) (Note this only runs in Splunk 8.0 and later.) Use <condition><progress /></condition> to set or unset a dedicated token for every possible SectionName value. If the value exist in that aggregate token, set the token, otherwise unset it. Use these dedicated tokens to hide or show tables, one for each possible SectionName value. You can read about hide-and-show in Access tokens to show or hide user interface components, about set dynamic tokens in Search tokens for dynamic display example. Here is a mock dashboard you can play with. (I included comments about the actual search that you can substitute.) Alas! The code is too long. You can download/copy from here: Mock table trellis in Splunk Simple XML. Here is a screenshot: As you can see, from your illustrated attribute list of 9, my mock search pretends to have found 4. So, only those 4 corresponding trellis show on the left-hand side. If you edit the attribute selection (in source), different tables will show. In edit mode, all 9 tables are visible, with hidden ones in grey. (Right-hand side is the big table you illustrated, with all 9 attributes.) Several notes: You could have saved volunteers lots of time (and done yourself a favor) by illustrating sample data that matches your desired output. The JSON in the description has too little in common with the table you show. As your search restricts SectionName to "Process Definition", it doesn't seem to make sense to list SectionName in the table. (SectionName is not an Attribute, any way.) But I still included it in my emulation. Maintenance is painful and not very scalable like a true trellis feature. Hope this helps.