Use the Table Editor
After you define the initial data for your table dataset, you use the Table Editor to refine it and maintain it. You also use the Table Editor to make changes to existing tables.
The Table Editor includes several table dataset editing tools:
- Work with your table in two views:
- Preview Rows, which renders the dataset in a standard table format.
- Summarize Fields, which displays statistical information for each of the fields in your table and their values.
- Apply actions to the table that filter events, add fields, edit field names and field values, perform statistical data aggregations, and more. You can apply actions through menu selections, or by making edits directly to table elements.
- Use a command history feature to review, edit, and delete actions that were applied to the table.
Get to the Table Editor
There are three ways to get to the Table Editor.
|When you define initial data for a new table dataset||See Define initial data for a new table dataset.|
|When you edit an existing table dataset.||See Manage table datasets.|
|When you extend a an existing dataset as a new table dataset||See Manage table datasets.|
See Define initial data for a new table dataset if you need help with this step of the dataset creation workflow.
Table Editor views
The Table Editor allows you to edit your table in two views. These views are named Preview Rows and Summarize Fields.
The Preview Rows view
Preview Rows is the default Table Editor view. It displays your table dataset as a table, with fields as columns, values in cells, and sample events in rows. It displays a sample 50 events from your dataset. It does not represent the results from any particular time range.
You can edit your table by applying actions to it, either by making menu selections, or by making edits directly to the table.
In the context of the Table Editor, the Preview Rows view is not designed to be an editing tool rather than a search tool. It does not provide a time range picker. If you would like to see a table-formatted set of results from a specific time range, save your table and go to the Datasets listing page to open it in the Explorer view. In the Explorer view, View Results displays results from a search over a time range that you can define.
See Explore a dataset.
Alternatively, you can switch to the Summarize Fields view of the Table Editor. It has a time range picker that lets you view field statistics for specific time ranges.
The Summarize Fields view
Click Summarize Fields to see analytical details about the fields in the table. You can see top value distributions, null value percentages, numeric value statistics, and more.
You can apply some menu actions and commands to your table while you are in the Summarize fields view. You can also apply actions through direct edits, such as moving columns, renaming fields, fixing field type mismatches, and editing field values.
Using the time range picker
When you are in the Summarize Fields view you can view field analytics for a specific range of time. The time range picker is near the top right side of the display.
The time range picker shows events from the last 24 hours by default. If your dataset has no events from the last 24 hours it will have no statistics when you open this view. To fix this, adjust the time range picker to a range where events are present.
The time range picker gives you a variety of time range definition options. You can choose a pre-set time range, or you can define a custom time range. For help with the time range picker, see Select time ranges to apply to your search in the Search Manual.
Table element selection options
Availability of menu actions depends on the table elements that you select. For example, some actions are only available when you select a field column.
You have the same selection options in the Preview Rows and Summarize Fields views.
|Element||Applies action to||How to select|
|Table||Entire dataset||Click the asterisk header at the top of the leftmost column.|
|Column||A field||Click on a column header.|
|Multi-Column||Two or more fields|| |
|Cell||A field value||Click a cell.|
|Text||A portion of text within a field value.||Click and drag to select text. You can select text for text and iPv4 field types.|
Each field belongs to a type. There are five field types.
Some actions and commands can only be applied to fields of specific types. For example, you can apply the Round Values and Map Ranges actions only to numeric fields.
The Table Editor automatically assigns types to fields when you define initial data for a dataset. It can also assign types to fields when you add fields to those datasets. If a field is assigned the wrong type, you can change the type either by direct table edit, or by using the Edit action menu.
You can apply actions to your table or elements of your table by making selections from the action menus just above it. Many of these actions can only be performed while you are in the Preview Rows view, but some can be performed in either view.
The actions and commands that you can apply to your table are categorized into the following menus.
|Edit||Contains basic editorial actions. Change field types, rename fields, move and delete fields.|
|Sort||Sort rows by the values of a selected field.|
|Filter||Provides actions that let you filter rows out of your dataset.|
|Clean||Features actions that fix or change field values.|
|Summarize||Perform statistical aggregations on your dataset.|
|Add new||Gives you different ways to add fields to your dataset.|
Apply actions through direct table edits
You can make edits to your table dataset by clicking on it. Move field columns, change field names, replace field values, and fix field type mismatches.
The following steps apply to both Table Editor views.
Move a field column
You can drag-and-drop field columns to new positions in your table.
- Select the column that you want to move.
- Click on the column header cell and drag the column to a new location in your table. When you do this, the column header cell moves with your mouse cursor.
- Release the mouse button to drop the column in its new location.
This action is not recorded by the Table Editor in the command history sidebar.
Change a field name
You can change a field name by double-clicking on it.
- Double-click on the column header cell that contains the name of the field that you want to change.
- Enter the new field name.
Field names cannot be blank, start with an underscore, or contain quotes, backslashes, or spaces.
- Click outside of the cell to complete the field name change.
The Table Editor records this change in the command history sidebar as a Rename field action.
Replace field values
Select a field value and replace every instance of it in its column with a new value. For example, if your dataset has an
action field with a value of
addtocart, you can replace that value with
add to cart.
You can use this method to fill null or empty field values.
You cannot make field value replacements on an event by event basis. When you use this method to replace a value in one event in your dataset, that value is changed for that field throughout your dataset.
For example, if you have an event where the
city field has a value of
New York, you cannot change that value to
Los Angeles just for that one event. If you change it to
Los Angeles, every instance of
New York in the
city column also changes to
- Double-click on a cell that contains the field value that you want to change.
- Edit the value or replace it entirely.
- Click outside of the cell to complete the the field replacement. Every instance of the field value in the field's column will be changed.
The Table Editor records this change in the command history sidebar as a Replace value action.
Fix field type mismatches
Sometimes fields have type mismatches. For example, a string field that has a lot of values with numbers in them might be mistyped as a numeric field. You can give a field the correct type by clicking on the type symbol in its column header cell.
You cannot change the type of the
- Find the column header cell of the mistyped field and hover over its type icon. The cursor changes to a pointing finger.
- Click on the type icon.
- Select the type that is most appropriate for the field.
This action is not recorded by the Table Editor in the command history sidebar.
The command history sidebar keeps track of the commands you apply as you apply them. You can click on a command record to reopen its command editor and change the values entered there.
When you click on a command that is not the most recent command applied, the Table Editor shows you how the table looked at that point in the command history.
You can edit the details of any command record in the command history. You can also delete any command in the history by clicking the X on its record. When you edit or delete a command record, you potentially can break commands that follow it. If this happens, the command history sidebar will notify you.
When you edit or delete a command that is not the most recent command applied, you can break commands that follow it. If this happens the command history sidebar will notify you.
Click SPL to see the search processing language behind your commands. When you have SPL selected you can click Open in Search to run a search using this SPL in the Search & Reporting view.
Save a new table
When you finish editing a table dataset you can click Save As to save it as a new table dataset.
- Click Save As to save your table.
- Give your dataset a unique Name.
- (Optional) Enter or update the Table ID. This value can only contain letters, numbers and underscores. It cannot be changed later.
- (Optional) Add a dataset Description.
Table dataset descriptions are visible in two places:
- The Dataset listing page, when you expand the table dataset row.
- The Explorer view of the table dataset, under the dataset name.
- Click Save to save your changes.
After you save a new table, you can choose one of three options.
|Continue Editing||Returns you to the Table Editor, where you can keep editing the dataset.|
|Explore Dataset||Opens the dataset in the Explorer view.|
|Done||Takes you to the Datasets listing page.|
Do not create table datasets with the same name
When you create table datasets, always give them unique names. If you have more than one table dataset with the same name in your system you risk experiencing object name collision issues that are difficult to resolve.
For example, say you have two table datasets named Store Sales, and you share one at the global level, but leave the other one private. If you then extend the global Store Sales dataset, the dataset that is created through that extension will display the table from the private Store Sales dataset instead.
Define initial data for a new table dataset
This documentation applies to the following versions of Splunk® Enterprise: 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12