Dashboards & Visualizations

reltime

lostcauz3
Path Finder
Tab1Tab2Tab3Tab4Tab5_time
200200200200200timestamp value
200200200200200timestamp value

 

the above data i'm getting from an index which has json data after writing 
index = xyz
| table Tab*,_time


Tab1Tab2Tab3Tab4Tab5_timereltime
200200200200200timestampsome hours ago


the above table i'm getting after adding
| sort - _time | head 1| reltime   to the above query

then i'm doing transpose column_name=Application_list | rename 'row 1' as Status 
| eval status = if((Status=200),"up","down)

is there any way to retain the reltime column to the above table after transposing it because i'm getting below output?

application_listStatus
Tab1up
Tab2up
Tab3up
Tab4up
Tab5up
reltimedown
_timedown

 

and i want it like


application_listStatusreltime
Tab1upx hours ago
Tab2upx hours ago
Tab3 upx hours ago
Tab 4upx hours ago
Tab 5upx hours go

 

 

below is the whole query:
index = xyz
| table Tab*,_time
| sort - _time | head 1| reltime
| transpose column_name=Application_list | rename 'row 1' as Status 
| eval status = if((Status=200),"up","down)

Labels (1)
0 Karma
1 Solution

tscroggins
Influencer
0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...