Dashboards & Visualizations

reltime

lostcauz3
Path Finder
Tab1Tab2Tab3Tab4Tab5_time
200200200200200timestamp value
200200200200200timestamp value

 

the above data i'm getting from an index which has json data after writing 
index = xyz
| table Tab*,_time


Tab1Tab2Tab3Tab4Tab5_timereltime
200200200200200timestampsome hours ago


the above table i'm getting after adding
| sort - _time | head 1| reltime   to the above query

then i'm doing transpose column_name=Application_list | rename 'row 1' as Status 
| eval status = if((Status=200),"up","down)

is there any way to retain the reltime column to the above table after transposing it because i'm getting below output?

application_listStatus
Tab1up
Tab2up
Tab3up
Tab4up
Tab5up
reltimedown
_timedown

 

and i want it like


application_listStatusreltime
Tab1upx hours ago
Tab2upx hours ago
Tab3 upx hours ago
Tab 4upx hours ago
Tab 5upx hours go

 

 

below is the whole query:
index = xyz
| table Tab*,_time
| sort - _time | head 1| reltime
| transpose column_name=Application_list | rename 'row 1' as Status 
| eval status = if((Status=200),"up","down)

Labels (1)
0 Karma
1 Solution

tscroggins
Influencer
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...