Getting Data In

Can i control the name of the column headers in a timechart using the by

HattrickNZ
Motivator

I have a search

...| timechart span=1h sum(kpi1) as Name1 by LABEL

This gives a 2 column output with _time and LABEL1 as there headers.

How Can I control the value LABEL1 of the header for the colum to be something else?

I have tried doing ...| strcat LABEL "-ALT" LABEL_ALT | timechart span=1h sum(kpi1) as Name1 by LABEL_ALT but this seem to divide the values in the `LABEL1 by 2 which is not what I want, maybe it is something to do with the data format.

0 Karma
1 Solution

HattrickNZ
Motivator

this works, if LABEL1 is the column header

...| timechart span=1h sum(kpi1) as Name1 by LABEL | rename LABEL1 as test123

View solution in original post

0 Karma

HattrickNZ
Motivator

this works, if LABEL1 is the column header

...| timechart span=1h sum(kpi1) as Name1 by LABEL | rename LABEL1 as test123

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...