Dashboards & Visualizations

reltime

lostcauz3
Path Finder
Tab1Tab2Tab3Tab4Tab5_time
200200200200200timestamp value
200200200200200timestamp value

 

the above data i'm getting from an index which has json data after writing 
index = xyz
| table Tab*,_time


Tab1Tab2Tab3Tab4Tab5_timereltime
200200200200200timestampsome hours ago


the above table i'm getting after adding
| sort - _time | head 1| reltime   to the above query

then i'm doing transpose column_name=Application_list | rename 'row 1' as Status 
| eval status = if((Status=200),"up","down)

is there any way to retain the reltime column to the above table after transposing it because i'm getting below output?

application_listStatus
Tab1up
Tab2up
Tab3up
Tab4up
Tab5up
reltimedown
_timedown

 

and i want it like


application_listStatusreltime
Tab1upx hours ago
Tab2upx hours ago
Tab3 upx hours ago
Tab 4upx hours ago
Tab 5upx hours go

 

 

below is the whole query:
index = xyz
| table Tab*,_time
| sort - _time | head 1| reltime
| transpose column_name=Application_list | rename 'row 1' as Status 
| eval status = if((Status=200),"up","down)

Labels (1)
0 Karma
1 Solution

tscroggins
Influencer
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

 Are you ready to revolutionize your IT operations? As digital transformation accelerates, the demand for ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...