Implementing Splunk 7, Third Edition - Third Edition

A table of fields based on field value

Since the template has access to everything in the event, you can use the fields in any way you like. The following example creates a horizontal table of fields but lets the user specify a specific set of fields to display in a special field.

Our template, stored in appserver/event_renderers/tabular.html, looks as follows:

<%inherit file="//results/EventsViewer_default_renderer.html" /> <%def name="event_raw(job, event, request, options, xslt)"> <% import sys _fields = str(event.fields.get('tabular', 'host,source,sourcetype,line count')).split(',') head = '' row = '' for f in _fields: head += "<th>" + f + "</th>" row += "<td>" + str(event.fields.get(f, '-')) + "</td>" %> <table class="tabular_eventtype"> ...