topic Re: How to change table column headings? in Splunk Search

How to change table column headings?

ny34940 — Wed, 10 Jan 2018 03:52:17 GMT

The search command that I have used is:
| chart list(field1) as A list(field2) as B by name month

The result I am getting is something like this
Name A : JAN A : FEB A : MAR B : JAN B : FEB B : MAR
abc

xyz

Desired result:

NAME JAN : A JAN : B FEB : A FEB : B MAR : A MAR : B
abc

xyz

I know the reason why I am getting the result but is there any way to change the names like the desired one?
Thanks in advance.

andrey2007 — Wed, 10 Jan 2018 12:23:04 GMT

Try to use rename

[your_search] | rename "A:*" as "*:A", "B:*" as "*:B"

mayurr98 — Wed, 10 Jan 2018 12:37:08 GMT

hey try this

<your_base_query> | chart list(field1) as A list(field2) as B over name by month | rename A:* as *:A B:* as *:B

let me know if this helps!

ny34940 — Sun, 14 Jan 2018 12:24:54 GMT

Thank you,it worked.

ny34940 — Sun, 14 Jan 2018 12:29:00 GMT

Thanks for the answer