Dashboards & Visualizations

Changing table column header names

brettcave
Builder

I have a result set that I want to display in a table, but customize the header names. My search uses append to get 2 sets of values, and then merges them using stats

search ...  | stats dc(VisitorID) as "visitors" by Ranges | append [ 
  search ... | stats dc(VisitorID) as "VisitorsWhoX" by Ranges 
]

Gives:

Ranges     visitors      VisitorsWhoX
0-10       11  
11-20      19
21-30      7
0-10                      6
11-20                     9
21-30                     2

From this point, I want to do 3 things: Merge the 2 searches by range, calc a 3rd column and rename the column headers. So I do the following:

... | stats last(visitors) as visitors last(VisitorsWhoX) as VisitorsWhoX by Ranges 
| eval "Conversion Rate"=round(VisitorsWhoX / visitors * 100)."%"
| eval "# of Visitors"=visitors | eval "Visitors who X"=VisitorsWhoX | table Ranges "# of Visitors" "Visitors who X" Ranges

Using this method does give me the results I work, just wondering if it can be optimized:

  1. Is there a better way to merge the results from 2 searches rather than using stats in the first line above?
  2. Is there a better way to rename column headers and display them? This report could expand to having up to 10 columns, and having 10 | eval "New Field"=oldfield" commands seems very inefficient.
Tags (1)
1 Solution

MHibbin
Influencer
  1. So you still want to the do the first method if possible but have the results in-line... how about the appendcols to add the fields to your main search and then include them in the table that way?
  2. Instead of using mulitple eval commands, why don't you use rename? Then you could do something like (for example):

..|rename visitors as "# of Visitors", VisitorsWhoX as "Visitors who X" |..

View solution in original post

MHibbin
Influencer
  1. So you still want to the do the first method if possible but have the results in-line... how about the appendcols to add the fields to your main search and then include them in the table that way?
  2. Instead of using mulitple eval commands, why don't you use rename? Then you could do something like (for example):

..|rename visitors as "# of Visitors", VisitorsWhoX as "Visitors who X" |..

brettcave
Builder

appendcols doesn't work because there isn't a 1 to 1 mapping of columns. in the example above, "VisitorsWhoX" may be null for 0-10 (I could set to 0 if isnull though).
rename: perfect. thank you.

0 Karma

kjamsheed
New Member

excellent. worked for me

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...