I have a search query that gives me data as
--------------------------------------------------
| {applicationid: app_1 |
| data_type: data_A |
| message: message_123 |
| } |
---------------------------------------------------
| {applicationid: app_2 |
| data_type: data_A |
| message: message_456 |
| } |
-------------------------------------------------
but I need to put this in splunk dash board as
-----------------------------------------------------
|data_type| Applicationid=app_1| Applicationid=app_2|
-----------------------------------------------------
|data_A | message_123 | message_456 |
|... | ... | .... |
---------------------------------------------------
↧