topic Re: Custom table view in Splunk Enterprise

Custom table view

vishwa — Tue, 12 Mar 2024 23:45:38 GMT

i have a query where my results looks like this

Application1-Start	Application1-Stop	Application2-Start	Application2-Stop	Application3-Start	Application3-Stop
10	4	12	7	70	30
12	8	10	4	3	2
14	4	12	5	16	12

But i want to see the output as shown below is that possible???

Start	Start	Start	Stop	Stop	Stop
Application1	Application2	Application3	Application1	Application2	Application3
10	12	70	4	7	30
12	10	3	8	4	2
14	12	16	4	5	12

Re: Custom table view

bowesmana — Wed, 13 Mar 2024 00:13:53 GMT

You can't do exactly that with a 2 line header, but depending on your SPL, yes, it's possible. I'm guessing you have those resuts from a chart or stats command. The columns are 'sorted', so all you need to do is make your column names

Start-ApplicationX and Stop-ApplicationX

so the starts come before the stops

or you can just take your existing table and use the table command to do

| table *Start *Stop

Re: Custom table view

vishwa — Thu, 14 Mar 2024 21:46:47 GMT

hank you it worked.