A table of fields based on field value

Since the template has access to everything in the event, you can use the fields in any way you like. The following example creates a horizontal table of fields but lets the user specify a specific set of fields to display in a special field.

Our template, stored in appserver/event_renderers/tabular.html, looks as follows:

<%inherit file="//results/EventsViewer_default_renderer.html" /> <%def name="event_raw(job, event, request, options, xslt)"> <% import sys _fields = str(event.fields.get('tabular', 'host,source,sourcetype,line count')).split(',') head = '' row = '' for f in _fields: head += "<th>" + f + "</th>" row += "<td>" + str(event.fields.get(f, '-')) + "</td>" %> <table class="tabular_eventtype"> ...

Get Implementing Splunk 7 - Third Edition now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.