Dashboards & Visualizations

Changing table column header names

brettcave
Builder

I have a result set that I want to display in a table, but customize the header names. My search uses append to get 2 sets of values, and then merges them using stats

search ...  | stats dc(VisitorID) as "visitors" by Ranges | append [ 
  search ... | stats dc(VisitorID) as "VisitorsWhoX" by Ranges 
]

Gives:

Ranges     visitors      VisitorsWhoX
0-10       11  
11-20      19
21-30      7
0-10                      6
11-20                     9
21-30                     2

From this point, I want to do 3 things: Merge the 2 searches by range, calc a 3rd column and rename the column headers. So I do the following:

... | stats last(visitors) as visitors last(VisitorsWhoX) as VisitorsWhoX by Ranges 
| eval "Conversion Rate"=round(VisitorsWhoX / visitors * 100)."%"
| eval "# of Visitors"=visitors | eval "Visitors who X"=VisitorsWhoX | table Ranges "# of Visitors" "Visitors who X" Ranges

Using this method does give me the results I work, just wondering if it can be optimized:

  1. Is there a better way to merge the results from 2 searches rather than using stats in the first line above?
  2. Is there a better way to rename column headers and display them? This report could expand to having up to 10 columns, and having 10 | eval "New Field"=oldfield" commands seems very inefficient.
Tags (1)
1 Solution

MHibbin
Influencer
  1. So you still want to the do the first method if possible but have the results in-line... how about the appendcols to add the fields to your main search and then include them in the table that way?
  2. Instead of using mulitple eval commands, why don't you use rename? Then you could do something like (for example):

..|rename visitors as "# of Visitors", VisitorsWhoX as "Visitors who X" |..

View solution in original post

MHibbin
Influencer
  1. So you still want to the do the first method if possible but have the results in-line... how about the appendcols to add the fields to your main search and then include them in the table that way?
  2. Instead of using mulitple eval commands, why don't you use rename? Then you could do something like (for example):

..|rename visitors as "# of Visitors", VisitorsWhoX as "Visitors who X" |..

brettcave
Builder

appendcols doesn't work because there isn't a 1 to 1 mapping of columns. in the example above, "VisitorsWhoX" may be null for 0-10 (I could set to 0 if isnull though).
rename: perfect. thank you.

0 Karma

kjamsheed
New Member

excellent. worked for me

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...