topic Re: how to change the fields in the dashboard for splunk in Splunk Enterprise

how to change the fields in the dashboard for splunk

ddp2kor — Tue, 20 Oct 2020 08:12:55 GMT

Hi,

In this dashboard ,i want the changing fields and coloumn.

For example I want the " planned_AB_ECD1" Beside to "Time spent in Hrs_AE_ECD1 ".pleas

Re: how to change the fields in the dashboard for splunk

inventsekar — Tue, 20 Oct 2020 08:45:55 GMT

Hi @ddp2kor may we know your current search query please, so that we can suggest easily.. the statistics table is created generally by "table" or "fields" command.

on these table/fields command, we can just "re-arrange" the order, thats it.

by seeing your screenshot, i assume, your search query is approximately:

Your current search query - base search | <some search queries> | table(or Fields) EMPName IT Planned_AB_ECD1 .....source sourcetype spl modified version: base search | <some search queries> | table(or Fields) EMPName IT "Planned_AB_ECD1" "Time spent in Hrs_AE_ECD1" .....source sourcetype spl

Re: how to change the fields in the dashboard for splunk

ITWhisperer — Tue, 20 Oct 2020 08:47:42 GMT

| transpose 0 | eval column=case(column="planned_AB_ECD1","AB_ECD1_A_planned",column="Time spent in Hrs_AB_ECD1","AB_ECD1_B_Hrs_AB_ECD1",true(),column) | sort column | eval column=case(column="AB_ECD1_A_planned","planned_AB_ECD1",column="AB_ECD1_B_Hrs_AB_ECD1","Time spent in Hrs_AB_ECD1",true(),column) | transpose 0 header_field=column | fields - column

Re: how to change the fields in the dashboard for splunk

inventsekar — Tue, 20 Oct 2020 08:57:21 GMT

Hi @ITWhisperer ..By reordering the fields on table/fields command, can not we re arrange this requirement?!?!

Re: how to change the fields in the dashboard for splunk

ITWhisperer — Tue, 20 Oct 2020 09:07:14 GMT

@inventsekar There are many ways to skin a cat!

If you know all the field / column names upfront, using table is one way to go.

If the column names are dependent on the data returned by the search (and these column names look like they might be), using transpose and re-evaluating the column names before sorting and re-evaluating back again provides opportunities to potentially use a more generic renaming scheme. Admittedly, if the column names are known and static, transpose is like using a sledgehammer to crack a nut.