Dashboards & Visualizations

Rename Columns not Fields

genesiusj
Builder

Hello,
Is it possible to rename a table column without renaming the field?
I have several child dashboards that I drill down to from a parent dashboard. In the parent dashboard I want to rename the columns to something more descriptive. However, all of these columns are also fields for other searches in the child dashboards.
Thanks and God bless,
Genesius

0 Karma

sandeepmakkena
Contributor
| rename Old_column as New_column_Name

I think you can just change the name, but when you pass tokens to other searches, you can pass the original name of the column as token value.
For example:
<set token=col>Old_column<set> you can use this token $col$ in your drilldown search.

Hope this helps, Thanks!

0 Karma

genesiusj
Builder

@sandeepmakkena
Just so I understand.
Although the field (column) has been renamed, and we can no longer use the original name in eval, rex, or other commands. However, the original name is still available to be used as a token which can be passed to other child dashboards, and other panels on the parent dashboard?

Thanks and God bless,
Genesius

0 Karma

jdhunter
Path Finder

See past answers submission below, he recommends using the rename command.

https://answers.splunk.com/answers/59171/changing-table-column-header-names.html

0 Karma

genesiusj
Builder

@jdhunter
Thank you.
This won't work for me. I know about the rename command. What I want to be able to do is rename the header in the table, not the field name itself.
For example.
Original field name: userId1, userId2
Both these fields are used in child dashboards. However, in the parent dashboard the column names for these two fields needs to be...
Remote Central Office User
Remote Branch Office User

I don't want to use those names as tokens for the subsequent child dashboards.

Is there a way to rename a table header AND NOT the field itself?

Thanks and God bless,
Genesius

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...