topic Table Column Headings in Splunk Search

Table Column Headings

Sriram — Tue, 28 Feb 2012 21:10:05 GMT

I am doing a search based on a pulldown values and displaying the results in a table. Here is the sample search
stats count(eval(val1)), count(eval(val2)) BY $viewby$, itemType | table $viewby$, "Item Type"

(where viewby is selected value from dropdown. Now the applicable values for viewby in the drop down are "type1", "type2", "type3". In the column header, I want to display "Type 1" for "type1". How can i do that. It is currently displaying "type1" as column header. rename command is not working as well. Appreciate your input.

Re: Table Column Headings

MHibbin — Tue, 28 Feb 2012 21:39:05 GMT

sriramvaidhyanathan,

You could pipe to the rename command at the end of the search(Splunk docs here), for example:

<your_search>| rename type1 AS "Type 1",type2 AS "Type 2"

As can be seen above, you can do this multiple times with one "rename" command... simply seperate with a comma (i.e. ",")

Hope this helps,

MHibbin

P.s. if this answers your question, please mark the answer as accepted/upvote the answer.

Re: Table Column Headings

Sriram — Wed, 29 Feb 2012 18:10:57 GMT

I was doing rename prior to the table. Something like this. stats count(eval(val1)), count(eval(val2)) BY $viewby$, itemType | rename $viewby$ AS ....| table ..... Changed rename to pipe at the end. Works fine now. Thanks for the help !

Re: Table Column Headings

andrewpense825 — Thu, 30 May 2024 20:00:45 GMT

I'm sure this has been asked to death but can I do this as an inline process during a table transforming command?