I want to add a new column to the existing dashboard how will I do it.

[rajneeshc1981]

I want to add a new column to the existing dashboard how will I do it.

I want to add a new column to the existing dashboard how will I do it.

[mayurr98]

Hi you can do that using appendcols at the end of your query.

Here is an example,

index=_internal 
| stats count by host source sourcetype 
|  appendcols 
    [| makeresults 
    |  eval data="a,b,c,d,e,f" 
    | makemv data delim="," | mvexpand data ]

Change names as required, data is the column name a,b,c,d,e,f are the manually added column values. Also, you can use table command at the end in order to sort column arrangements as required.

let me know if this helps!

[marycordova]

It depends on if the dashboard panel is an inline search or a report.

You can edit the search directly inline, otherwise you need to edit the report the panel relies on.

For a specific answer please post a copy of your spl and sample data set with a problem statement about what data/column you want added.

[rajneeshc1981]

index=pear splunk_server_group=all sourcetype="chef_host_details" * host_tc="" pvc_grp="" NOT (host_is_dr=1) NOT (host_pod_is_live=0) earliest=-4h latest=now
| mvexpand roles{}| rename roles{} as toll list | search tolllist!="base" AND roleslist=*** | search tolllist=*

|dedup tolllist host | mvcombine tolllist| sort host tolllist| table host host_tc pvc_grp tolllist

this creates 4 column >> hosts >> host_tc,pvc_grp,tollist , I want to add another column before hosts and add manually some data .

[marycordova]

add an eval statement like:

| eval newfield="however you want to calculate the values of the new field/column"

add the name of the field/column you want in your table statement:

| table newfield host host_tc pvc_grp tolllist

also there might be a type or two in your query:

rename roles{} as tolllist | search tolllist!="base" AND roleslist=*

[skoelpin]

You will never get an accurate answer with such a vague question. Try posting your current output and query