CODEWITHSUNDEEP
splunk
David Doria
David Doria

Reputation: 10273

Create a static table in Splunk

I have a tiny table of data that I want to display as a reference on a dashboard - something like:

date | val1 | val2
9/16/2020 | 10 | 12
9/17/2020 | 11 | 14
9/18/2020 | 12 | 13

that I want to display as a line chart:

enter image description here

I found this very convoluted way to construct it:

| makeresults 
| eval testDay="9/16/2020"
| eval testVal1=10
| eval testVal2=12
| append 
    [| makeresults 
    | eval testDay="9/17/2020"
    | eval testVal1=11
    | eval testVal2=14
    ]
| append 
    [| makeresults 
    | eval testDay="9/18/2020"
    | eval testVal1=12
    | eval testVal2=13
    ]
| chart first(testVal1), first(testVal2) over testDay

is there a simpler way? Perhaps something more like my little tabular syntax in the table at the beginning of the post? Or at least more like:

val1 = [10,11,12]

Upvotes: 1

Views: 1442

Answers (1)

RichG
RichG

Reputation: 9926

There is a simpler way. It's what I use to produce test data when answering questions about Splunk.

| makeresults
| eval _raw="date      val1 val2
9/16/2020 10   12
9/17/2020 11   14
9/18-2020 12   13"
| multikv forceheader=1
| chart values(val1) as val1, values(val2) as val2 by date

It's important for mutlikv to work properly that the header and data line up vertically.

Upvotes: 2

Related Questions