Dashboards & Visualizations

reltime

lostcauz3
Path Finder
Tab1Tab2Tab3Tab4Tab5_time
200200200200200timestamp value
200200200200200timestamp value

 

the above data i'm getting from an index which has json data after writing 
index = xyz
| table Tab*,_time


Tab1Tab2Tab3Tab4Tab5_timereltime
200200200200200timestampsome hours ago


the above table i'm getting after adding
| sort - _time | head 1| reltime   to the above query

then i'm doing transpose column_name=Application_list | rename 'row 1' as Status 
| eval status = if((Status=200),"up","down)

is there any way to retain the reltime column to the above table after transposing it because i'm getting below output?

application_listStatus
Tab1up
Tab2up
Tab3up
Tab4up
Tab5up
reltimedown
_timedown

 

and i want it like


application_listStatusreltime
Tab1upx hours ago
Tab2upx hours ago
Tab3 upx hours ago
Tab 4upx hours ago
Tab 5upx hours go

 

 

below is the whole query:
index = xyz
| table Tab*,_time
| sort - _time | head 1| reltime
| transpose column_name=Application_list | rename 'row 1' as Status 
| eval status = if((Status=200),"up","down)

Labels (1)
0 Karma
1 Solution

tscroggins
SplunkTrust
SplunkTrust
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Picture this. You arrive at .conf26 already having your socializing and networking plans mapped out. No ...

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Implementing Zero Trust (ZT) across complex environments often falters at the very beginning due to a ...