topic Re: Changing table column header names in Dashboards & Visualizations

Changing table column header names

brettcave — Wed, 19 Sep 2012 11:46:04 GMT

I have a result set that I want to display in a table, but customize the header names. My search uses append to get 2 sets of values, and then merges them using stats

search ...  | stats dc(VisitorID) as "visitors" by Ranges | append [ 
  search ... | stats dc(VisitorID) as "VisitorsWhoX" by Ranges 
]

Gives:

Ranges     visitors      VisitorsWhoX
0-10       11  
11-20      19
21-30      7
0-10                      6
11-20                     9
21-30                     2

From this point, I want to do 3 things: Merge the 2 searches by range, calc a 3rd column and rename the column headers. So I do the following:

... | stats last(visitors) as visitors last(VisitorsWhoX) as VisitorsWhoX by Ranges 
| eval "Conversion Rate"=round(VisitorsWhoX / visitors * 100)."%"
| eval "# of Visitors"=visitors | eval "Visitors who X"=VisitorsWhoX | table Ranges "# of Visitors" "Visitors who X" Ranges

Using this method does give me the results I work, just wondering if it can be optimized:

Is there a better way to merge the results from 2 searches rather than using stats in the first line above?
Is there a better way to rename column headers and display them? This report could expand to having up to 10 columns, and having 10 | eval "New Field"=oldfield" commands seems very inefficient.

Re: Changing table column header names

MHibbin — Wed, 19 Sep 2012 13:12:37 GMT

So you still want to the do the first method if possible but have the results in-line... how about the appendcols to add the fields to your main search and then include them in the table that way?
Instead of using mulitple eval commands, why don't you use rename? Then you could do something like (for example):

..|rename visitors as "# of Visitors", VisitorsWhoX as "Visitors who X" |..

Re: Changing table column header names

brettcave — Wed, 19 Sep 2012 14:47:29 GMT

appendcols doesn't work because there isn't a 1 to 1 mapping of columns. in the example above, "VisitorsWhoX" may be null for 0-10 (I could set to 0 if isnull though).
rename: perfect. thank you.

Re: Changing table column header names

kjamsheed — Mon, 09 Nov 2015 16:55:43 GMT

excellent. worked for me