topic Re: Append Column Header Field with Multivalues in Splunk Search

Append Column Header Field with Multivalues

cchange — Mon, 11 Nov 2019 20:20:08 GMT

I need to show my table column header in below format. I need to get column name and static header under my column.

Students
Total/Pres/Abs

Can someone please let me know how I can get this format.

gaurav_maniar — Mon, 11 Nov 2019 20:41:48 GMT

Please provide proper example with sample output and expected output.

cchange — Mon, 11 Nov 2019 21:31:36 GMT

search query | table students | rename students as Students (Total/Pres/Abs)

Current Output:
Students (Total/Pres/Abs)
100/80/20

Desired Output:
Students
(Total/Pres/Abs)
100/80/20

woodcock — Tue, 12 Nov 2019 01:31:05 GMT

Like this:

| makeresults
| eval host="test"
| table host
| rename host as "Students
(Total/Pres/Abs)"

cchange — Tue, 12 Nov 2019 21:24:56 GMT

Thanks it got worked.