Dashboards & Visualizations

search results in tree view

yaminims
New Member

I have a query which gives values repeated in a metric, hence i am reaching out to find out if SPLUNK supports enabling Tree view for search results

E.g.:

This is the current result

Value1 ABC 50
Value1 BCD 20
Value1 CDE 10
Value1 EFG 11
Value2 ABC 50
Value2 BCD 20

I am trying to find out if there is a way to turn on the Tree view in the result set for SPLUNK:

E.g:

  • Value1
  • Value2

if we expand the Value1 the above list for Value1 should be displayed

Tags (2)
0 Karma

sideview
SplunkTrust
SplunkTrust

Well you can do it by implementing a series of clickable tables in a custom view.

For instance if you are using Sideview Utils, and your base search was

foo bar | stats count by field1 field2

You could have

<module name="Search">
  <param name="search">foo bar | stats count by field1 field2</param>
  <module name="JobProgressIndicator"></module>
  <module name="PostProcess">
    <param name="search">stats sum(count) as count by field1</param>
    <module name="Pager">
      <module name="Table">
        <module name="PostProcess">
          <param name="search">search field1="$row.fields.field1$" | stats sum(count) as count by field2</param>
          <module name="Pager">
            <module name="Table"></module>
          </module>
        </module>
      </module>
    </module>
  </module>
</module>

This would display an intial table with just the "value1", "value2" values, and the aggregate counts, and clicking the rows on that table would show a second table with the ABC, BCD, CDR values specific to that first value, and the counts thereof. You would probably want to add in some headers, with maybe the HTML module.

To do this sort of view in just the core Splunk advanced XML would be possible although it would be a great deal more verbose, you wouldn't be able to use postProcess, and you'd have to understand how intentions work. But it could be done that way too.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...