Dashboards & Visualizations

Methods to create tables and visualizations

palisetty
Communicator

There are three ways
1. We can use SPL to write transforming commands like chart and timechart and create tables and visualizations
2. We can use pivots

These two are okay.

  1. We can create from the fields sidebar. I don't know how is it done?

If I select any field and click on quick reports, it create visualizations for sure but the events are not in tabular format. Kindly clear the confusion.

Tags (1)
0 Karma
1 Solution

niketn
Legend

@palisetty if you are able to see visualization then you can check just below the search bar that you are under the Visualization tab. All you need to do is that click on the Statistics tab and the Tabular results will show up.

For example if you have searched Splunk's _internal index, you can select a field like sourcetype and then choose Report > Top values by Time. If you have any visualization selected last, it would show the Visualization tab with that viz. selected. Here, you can see Statistics tab and click on the same to get the tabular output.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

palisetty
Communicator

Thank You.

0 Karma

niketn
Legend

@palisetty if you are able to see visualization then you can check just below the search bar that you are under the Visualization tab. All you need to do is that click on the Statistics tab and the Tabular results will show up.

For example if you have searched Splunk's _internal index, you can select a field like sourcetype and then choose Report > Top values by Time. If you have any visualization selected last, it would show the Visualization tab with that viz. selected. Here, you can see Statistics tab and click on the same to get the tabular output.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...