Splunk dashboard tables with Heading and SubHeading

[jhlopez]

Hi All,

Can I create a table that has a heading and subheading as well just like the below example??

Head1 | Head2 |
| SubHead2A | Subhead2B |
data1 value1A value1B
data2 value2A value2B
data3 value2A value3B

Thanks in advance!..

[sideview · Accepted solution]

Not really, but Table Embedding can come pretty close.

Here is an example that will work for you locally, that just uses some common data from index=_internal. It creates a dummy row at the top of the results, and then uses Table Embedding to basically put the two statistics inside their own table inside a field that we just made up... And then it hides the other "real" cells with the "hiddenFields" param.

I pulled out as much as I could into a separate postprocess search. Note that you do need something like the | table stats * to force the field to exist in the base search.

<module name="Search" autoRun="True">
  <param name="search"><![CDATA[
    index=_internal source=*metrics.log group="per_*_thruput" | head 1000 | stats sum(kb) as kb max(eps) as maxEps by group | eval stats="placeholder"
  ]]></param>

  <module name="PostProcess">
    <param name="search"><![CDATA[ 
    | reverse | append [| stats count | eval group="" | fields - count] | reverse | fields group stats kb maxEps | eval kb=if(group=="","<b>kb</b>",kb) | eval maxEps=if(group=="","<b>maxEps</b>", maxEps)
    ]]></param>

    <module name="Pager">

      <module name="Table">
        <param name="hiddenFields">kb, maxEps</param>

        <module name="HTML" group="row.fields.stats">
          <param name="html"><![CDATA[
            <table>
              <tr>
                <td style="border-bottom:0px;width:100px;">$row.fields.kb$</td>
                <td style="border-bottom:0px;">$row.fields.maxEps$</td>
              </tr>
            </table>
          ]]></param>
        </module>
      </module>
    </module>
  </module>
</module>

Make sure to read the docs about Table Embedding that are inside the Sideview Utils app.
navigate within the app's navigation menu to "Module Documentation > The Table Module > Table - Embedding examples"

Here's a screenshot:

[jhlopez]

Thanks for this..