The only way in which this can be done with the core splunk UI is to use an event_renderer, but it's very tricky and full of pitfalls.
here's as simple example as I can give, and it will just render a couple fields wrapped in <p> tags. However you could use CSS to give them a floated layout instead.
Note that this example is borrowed from my CDR/CMR app (not yet released)
Step 1: in event_renderers.conf
[simple_field_display]
eventtype = simple_field_display
priority = 1
template = simple_field_display.html
Step 2:
<%inherit file="//results/EventsViewer_default_renderer.html" />
<%def name="event_layout(job, event, request, options, xslt)">
<%
def getFieldValue(event, name):
if event.fields.has_key(name) :
for i, f in enumerate(event.fields[name]):
return f
field1 = getFieldValue(event, "some_interesting_field_name")
field2 = getFieldValue(event, "some_other_interesting_field_name")
%>
<p>${field1|h}, ${field2|h}</p>
</%def>
Step 3:
In your XML, in whatever search is being used to render the events in the EventsViewer module, tack this onto the end of it
| eval eventtype="simple_field_display"
Step 4: restart splunk.
onto the end of the search. As long as you're using EventsViewer in the normal 'events' mode, this should work.
In other news I have an amazing prototype module that I'm working on called "Multiplexer" but it's a very tricky thing to get right. I do kind of need the module for some of my apps so I'll probably get it working and polished and documented soon as a part of sideview_utils.
