The Splunk configuration options that are available for split (row and column) depend on the type of attribute you choose for them.
Those configuration options, regardless of attribute type, are:
- Both split row and split column:
- Max rows and max columns: This is the maximum number of rows or columns that can appear in the results table
- Totals: Indicates whether to include a row or column that represents the total of all the others in an attribute called ALL
- Only split row elements:
- Label: Is used to override the attribute name with a different text or character string
- Sort: Used to reorder ...