简体   繁体   中英

Create a static table in Splunk

I have a tiny table of data that I want to display as a reference on a dashboard - something like:

date | val1 | val2
9/16/2020 | 10 | 12
9/17/2020 | 11 | 14
9/18/2020 | 12 | 13

that I want to display as a line chart:

在此处输入图片说明

I found this very convoluted way to construct it:

| makeresults 
| eval testDay="9/16/2020"
| eval testVal1=10
| eval testVal2=12
| append 
    [| makeresults 
    | eval testDay="9/17/2020"
    | eval testVal1=11
    | eval testVal2=14
    ]
| append 
    [| makeresults 
    | eval testDay="9/18/2020"
    | eval testVal1=12
    | eval testVal2=13
    ]
| chart first(testVal1), first(testVal2) over testDay

is there a simpler way? Perhaps something more like my little tabular syntax in the table at the beginning of the post? Or at least more like:

val1 = [10,11,12]

There is a simpler way. It's what I use to produce test data when answering questions about Splunk.

| makeresults
| eval _raw="date      val1 val2
9/16/2020 10   12
9/17/2020 11   14
9/18-2020 12   13"
| multikv forceheader=1
| chart values(val1) as val1, values(val2) as val2 by date

It's important for mutlikv to work properly that the header and data line up vertically.

The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.

 
粤ICP备18138465号  © 2020-2024 STACKOOM.COM