Dashboards & Visualizations

How to display the column contents in table?

Sss
Path Finder

I have my report where I have written something like this-

|dbxquery query="select COLUMN1,COLUMN2,COLUMN3,COLUMN4
FROM TABLE1
WHERE COLUMN1 IN ('xyz') ",connection="XXX"

I have added this to my dashboard by using query-

| savedsearch rep1
| chart values(column3) AS Status BY column2 column4
| fillnull value="-"
| table column1 column2 ......

In my dashboard,values of COLUMN1 are not displayed.

Is there any way how i can display value of column1 i.e;xyz

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

That is not a very clear answer. Do you mean something like this?

| stats values(column3) AS Status BY column1 column2 column4
| eval {column4} = Status
| fields - Status column4
| stats values(*) as * by column1 column2
| fillnull value="-"

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

On a less flippant note, please provide more detail.

Do you want to replace some of the existing data in the table, or have the column1 values as extra?

If you want them as extra, how are they to be combined with the existing data?

0 Karma

Sss
Path Finder

I dont want to replace any data,but have to include that Column1 which will display value as 'xyz'.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You still haven't answered the final question. How does column1 relate to the other data you want to display?

For example, is there a one-to-one relationship between column1 and column2, or can there be multiple values of column1 for every combination of column2 and column4?

0 Karma

Sss
Path Finder

The reamining column are with respect to COLUMN1,i.e; its related to that particular group say 'xyz'.

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

That is not a very clear answer. Do you mean something like this?

| stats values(column3) AS Status BY column1 column2 column4
| eval {column4} = Status
| fields - Status column4
| stats values(*) as * by column1 column2
| fillnull value="-"

Sss
Path Finder

Thank you so much,it worked for me

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| chart values(column3) AS Status BY column1 column4
0 Karma

Sss
Path Finder

I have used this command,but only column name is displaying without any data in that column.

0 Karma
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...