Dashboards & Visualizations

reltime

lostcauz3
Path Finder
Tab1Tab2Tab3Tab4Tab5_time
200200200200200timestamp value
200200200200200timestamp value

 

the above data i'm getting from an index which has json data after writing 
index = xyz
| table Tab*,_time


Tab1Tab2Tab3Tab4Tab5_timereltime
200200200200200timestampsome hours ago


the above table i'm getting after adding
| sort - _time | head 1| reltime   to the above query

then i'm doing transpose column_name=Application_list | rename 'row 1' as Status 
| eval status = if((Status=200),"up","down)

is there any way to retain the reltime column to the above table after transposing it because i'm getting below output?

application_listStatus
Tab1up
Tab2up
Tab3up
Tab4up
Tab5up
reltimedown
_timedown

 

and i want it like


application_listStatusreltime
Tab1upx hours ago
Tab2upx hours ago
Tab3 upx hours ago
Tab 4upx hours ago
Tab 5upx hours go

 

 

below is the whole query:
index = xyz
| table Tab*,_time
| sort - _time | head 1| reltime
| transpose column_name=Application_list | rename 'row 1' as Status 
| eval status = if((Status=200),"up","down)

Labels (1)
0 Karma
1 Solution

tscroggins
Motivator
0 Karma

tscroggins
Motivator
0 Karma
Get Updates on the Splunk Community!

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...