Dashboards & Visualizations

In my dashboard, can four tables be joined into one?

samwatson45
Path Finder

Hi,

I have a dashboard which in which one of the panels features a table, currently made out of 4 separate searches (technically 4 tables just next to each other), like so:

alt text

The searches for each one look like this:

base search... | stats   latest(AvailabilityFlex)  AS Availability latest(RollOutFlex) AS RollOut  latest(LeadershipFlex) AS Leadership

Where for the other metrics the stats command looks for other metrics, i.e

base search ... | stats  latest(AvailabilitySub)  AS Availability  latest(RollOutSub) AS RollOut  latest(LeadershipSub) AS Leadership

Is there an easy way of combining these searches all into one table, with the same structure as it currently has? A table with 4 columns and 4 rows, the first column one being the 'metric' and the name of that for each row?

Thanks,
Sam

EDIT: The reason for this is because when you generate the PDF it really stretches out the table, making it look much less professional. If anyone knows how to keep panels all grouped together when doing this, that would also work!

0 Karma
1 Solution

harishalipaka
Motivator
 base search... | stats   latest(AvailabilityFlex)  AS Availability latest(RollOutFlex) AS RollOut  latest(LeadershipFlex) AS Leadership |eval a="query1"|append [ base search... | stats   latest(AvailabilityFlex)  AS Availability latest(RollOutFlex) AS RollOut  latest(LeadershipFlex) AS Leadership |eval a="query2"] |append [ base search... | stats   latest(AvailabilityFlex)  AS Availability latest(RollOutFlex) AS RollOut  latest(LeadershipFlex) AS Leadership |eval a="query3"]

details about append

differance between append and appendcols

Thanks
Harish

View solution in original post

harishalipaka
Motivator
 base search... | stats   latest(AvailabilityFlex)  AS Availability latest(RollOutFlex) AS RollOut  latest(LeadershipFlex) AS Leadership |eval a="query1"|append [ base search... | stats   latest(AvailabilityFlex)  AS Availability latest(RollOutFlex) AS RollOut  latest(LeadershipFlex) AS Leadership |eval a="query2"] |append [ base search... | stats   latest(AvailabilityFlex)  AS Availability latest(RollOutFlex) AS RollOut  latest(LeadershipFlex) AS Leadership |eval a="query3"]

details about append

differance between append and appendcols

Thanks
Harish

samwatson45
Path Finder

Thanks! This works great.
Do you know how to get the additional column (a=query1, etc) to be at the left of the table rather than the right?

0 Karma

Sukisen1981
Champion

what happens if you just pipe after the query above , something like base search... | stats latest(AvailabilityFlex) AS Availability latest(RollOutFlex) AS RollOut latest(LeadershipFlex) AS Leadership |eval a="query1"|append [ base search... | stats latest(AvailabilityFlex) AS Availability latest(RollOutFlex) AS RollOut latest(LeadershipFlex) AS Leadership |eval a="query2"] |append [ base search... | stats latest(AvailabilityFlex) AS Availability latest(RollOutFlex) AS RollOut latest(LeadershipFlex) AS Leadership |eval a="query3"]| fields a,Availability,RollOut,Leadership

Basically just provide the fields in the respective order that you need with the |fields command?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...