topic Re: Adding an second identical column and field to Splunk table in Splunk Search

Adding an second identical column and field to Splunk table

dxw350 — Sun, 18 Jun 2017 21:36:10 GMT

In order to coincide with an excel spreadsheet, I was hoping that Splunk table can provide two columns that our identical but listed with data at the beginning and the middle of the table sheet. Is there a way to have the same field name column more than once?

Re: Adding an second identical column and field to Splunk table

cmerriman — Sun, 18 Jun 2017 23:05:47 GMT

I don't believe you can have the same field name. The closest you could do is different capitalization or adding a special character to it.

Re: Adding an second identical column and field to Splunk table

DalJeanis — Sun, 18 Jun 2017 23:11:16 GMT

Heh.

Two answers in one: No, it can't but you can make humans think it did.

The run anywhere sample code looks like this ...

 | makeresults 
 | eval george = "first one" 
 | eval frank = "second one" 
 | rename frank as " george" 
 | table _time george " george"

... with the resulting output...

 _time                george      george 
 2017-06-18 23:07:44  first one  second one

You can also just change the capitalization rather than including invisible spaces in the field name. Humans will disregard the difference.