A couple weeks ago some folks in the splunk-usergroups.slack helped me using accum and calculating with a modulus to make a grid menu from a list.
My original search had been along the lines of:
| inputlookup mylookup
| stats count by type
| fields - count
| transpose
| fields - column
Which was great … until my list grew more than about 12 entries (and scrolling became a pain).
A couple folks here helped me flip it to this format:
| Inputlokup mylookup
| stats count by type
| eval num=1
| accum num
| eval num=num-1
| eval mod=floor(num/12)
| eval type.{mod}=type
| fields - mod num type count
| stats list(*) as *
Which works awesomely.
Unless the modulus value (currently 12) gets too small (if the total list grows to more than modval^2 .. each individual box is no longer in alphabetical order (and then alpha from box to box).
So I made this modification so that regardless of the size of the list, the grid will automanage itself:
| inputlookup mylookup
| stats count by type
| eventstats count as _tot
| eval modval=ceil(sqrt(_tot))
| eval num=1
| accum num
| eval num=num-1
| eval mod-floor(num/modval)
| eval type.{mod}=type
| fields - modval mod num type count
| stats list(*) as *
Dunno if that’ll help anyone else, but wanted to share-back that self-managing aspect I added in case anyone was interested 