Splunk Search

How to have Pivot Report show both chart and table

pal4life
Path Finder

Hi,
I was reviewing this tutorial on Youtube about how to create Pivot report
https://www.youtube.com/watch?v=MdjDrDTXYWQ#t=1.819614

It shows both the Chart as well as the tablealt text Although when I create a Pivot report it only shows me the chart but not the table below it, how do I get the table to show up below the chart?

So that information is readily available there.

Thanks.

rjthibod
Champion

What you are asking to do requires that you create a dashboard of your own if you want to do it the most efficient way with only a single search.

Without having the original content, I can only show you the pseudocode to product what you are looking for. You will have to plug in the names for DATAMODEL, EVENT_NAME, sales_field, and product_field.

<form>
  <label>Product Sales by Host</label>
  <fieldset autoRun="true" submitButton="false">
    <input type="time" searchWhenChanged="true">
      <label>Search Period</label>
      <default>
        <earliest>-7d@d</earliest>
        <latest>now</latest>
      </default>
    </input> 
  </fieldset>
  <row>
    <panel>
      <chart>
        <search id="search_sales_by_host">
          <query>
            | pivot <DATAMODEL> <EVENT_NAME> sum(<sales_field>) AS sales SPLITROW <product_name_field> as "product name" SPLITCOL host TOP 20 sum(<sales_field>) ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 20 SHOWOTHER 0 
          </query>
        </search>
        <option name="drilldown">none</option>
        <option name="charting.chart">bar</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY.text">Product Name</option>        
        <option name="charting.axisTitleX.text">Sum of Price ($)</option>        
      </chart>
      <table>
        <search base="search_sales_by_host">
        </search>
        <option name="count">20</option>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>
0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...