Dashboards & Visualizations

Changing table column header names

brettcave
Builder

I have a result set that I want to display in a table, but customize the header names. My search uses append to get 2 sets of values, and then merges them using stats

search ...  | stats dc(VisitorID) as "visitors" by Ranges | append [ 
  search ... | stats dc(VisitorID) as "VisitorsWhoX" by Ranges 
]

Gives:

Ranges     visitors      VisitorsWhoX
0-10       11  
11-20      19
21-30      7
0-10                      6
11-20                     9
21-30                     2

From this point, I want to do 3 things: Merge the 2 searches by range, calc a 3rd column and rename the column headers. So I do the following:

... | stats last(visitors) as visitors last(VisitorsWhoX) as VisitorsWhoX by Ranges 
| eval "Conversion Rate"=round(VisitorsWhoX / visitors * 100)."%"
| eval "# of Visitors"=visitors | eval "Visitors who X"=VisitorsWhoX | table Ranges "# of Visitors" "Visitors who X" Ranges

Using this method does give me the results I work, just wondering if it can be optimized:

  1. Is there a better way to merge the results from 2 searches rather than using stats in the first line above?
  2. Is there a better way to rename column headers and display them? This report could expand to having up to 10 columns, and having 10 | eval "New Field"=oldfield" commands seems very inefficient.
Tags (1)
1 Solution

MHibbin
Influencer
  1. So you still want to the do the first method if possible but have the results in-line... how about the appendcols to add the fields to your main search and then include them in the table that way?
  2. Instead of using mulitple eval commands, why don't you use rename? Then you could do something like (for example):

..|rename visitors as "# of Visitors", VisitorsWhoX as "Visitors who X" |..

View solution in original post

MHibbin
Influencer
  1. So you still want to the do the first method if possible but have the results in-line... how about the appendcols to add the fields to your main search and then include them in the table that way?
  2. Instead of using mulitple eval commands, why don't you use rename? Then you could do something like (for example):

..|rename visitors as "# of Visitors", VisitorsWhoX as "Visitors who X" |..

brettcave
Builder

appendcols doesn't work because there isn't a 1 to 1 mapping of columns. in the example above, "VisitorsWhoX" may be null for 0-10 (I could set to 0 if isnull though).
rename: perfect. thank you.

0 Karma

kjamsheed
New Member

excellent. worked for me

0 Karma
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...